create-ailk 0.23.0 → 0.25.1

package/templates/apps/api/src/services/__tests__/consent-ledger.test.ts

@@ -1,503 +0,0 @@
-/**
- * @file consent-ledger.test.ts
- * @description The consent ledger's writers (#8438 D3) — `recordCookieChoice`,
- * `recordPersonConsent`, `linkConsentVisitor`, the unsubscribe token, and the
- * `source` contract of `recordConsent`.
- *
- * External dependency boundaries mocked:
- *   - @working-theory/database (via moduleNameMapper -> prisma-client.js mock;
- *     prisma singleton via __mocks__/prisma.ts)
- *
- * The ledger is modelled in memory: `$transaction` runs its callback on the
- * mocked client, `consentGrant.createMany` appends, and `$queryRaw` answers
- * the way the store's `DISTINCT ON` queries would — newest row per purpose —
- * so the "writes only when the answer changes" rule is exercised end to end.
- */
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../../lib/prisma.js");
-
-import {
-  PLATFORM_CONSENT_CONFIG,
-  resolveConsentStatement,
-  SITE_CONSENT_CONFIG_DEFAULTS,
-  siteConsentConfigSchema,
-} from "@working-theory/validation";
-
-import {
-  armConsentLedger,
-  type LedgerRow,
-  type LinkRow,
-} from "../../lib/__tests__/consent-ledger-double.js";
-import { prisma } from "../../lib/prisma.js";
-
-import {
-  ConsentLinkSecretMissing,
-  consentLinkSecretConfigured,
-  consentUnsubscribeToken,
-  linkConsentVisitor,
-  recordConsent,
-  recordCookieChoice,
-  recordPersonConsent,
-  verifyConsentUnsubscribeToken,
-} from "../consent";
-
-const WS = "wksp_01920000-0000-7000-8000-0000000000a1";
-const PERSON = "person_01920000-0000-7000-8000-0000000000a1";
-const VISITOR = "0192a000-0000-4000-8000-0000000000a1";
-
-type Row = LedgerRow;
-
-const CONFIG = siteConsentConfigSchema.parse({
-  policies: { terms: "/terms", privacy: "/privacy" },
-  purposes: [
-    {
-      id: "service_terms",
-      required: true,
-      kind: "agreement",
-      policy: "terms",
-      label: { en: "You agree." },
-    },
-    {
-      id: "product_news",
-      kind: "preference",
-      area: "communications",
-      label: { en: "Product news." },
-    },
-    {
-      id: "share_data",
-      kind: "consent",
-      area: "data",
-      label: { en: "Share usage data." },
-    },
-    {
-      id: "analytics_cookies",
-      kind: "consent",
-      area: "cookies",
-      label: { en: "Analytics cookies." },
-    },
-  ],
-});
-
-/** The in-memory ledger every case appends to (`lib/__tests__/consent-ledger-double.ts`). */
-let ledger: Row[] = [];
-let links: LinkRow[] = [];
-
-function newest(rows: Row[], purposeId?: string): Row | null {
-  const matching = rows.filter((r) => purposeId === undefined || r.purposeId === purposeId);
-  return matching.length === 0 ? null : matching[matching.length - 1]!;
-}
-
-beforeEach(() => {
-  jest.clearAllMocks();
-  const double = armConsentLedger(prisma);
-  ledger = double.ledger;
-  links = double.links;
-});
-
-describe("recordConsent carries the ledger fields (#8438 D3)", () => {
-  it("stamps personId, source, sourceRef and the purpose's policy version on every row", async () => {
-    await recordConsent({
-      siteId: WS,
-      subjectType: "lead",
-      subjectId: "lead_1",
-      personId: PERSON,
-      source: "magnet",
-      sourceRef: "free-guide",
-      locale: "en",
-      config: CONFIG,
-      consents: { service_terms: true, share_data: false },
-    });
-    expect(ledger).toHaveLength(2);
-    expect(ledger[0]).toMatchObject({
-      personId: PERSON,
-      source: "magnet",
-      sourceRef: "free-guide",
-      policyVersion: 1,
-    });
-  });
-
-  it("is a type error to write a row with no source", async () => {
-    await recordConsent(
-      // @ts-expect-error -- `source` is required: every writer must say where the answer came from.
-      {
-        siteId: WS,
-        subjectType: "lead",
-        subjectId: "lead_1",
-        personId: null,
-        locale: "en",
-        config: CONFIG,
-        consents: { service_terms: true },
-      },
-    );
-  });
-});
-
-describe("recordPersonConsent (#8438 D3)", () => {
-  const base = {
-    workspaceId: WS,
-    personId: PERSON,
-    locale: "en",
-    config: CONFIG,
-    subject: { subjectType: "person", subjectId: PERSON },
-  };
-  const settings = (purposeId: string, granted: boolean) =>
-    recordPersonConsent({
-      ...base,
-      purposeId,
-      granted,
-      source: "account_settings",
-    });
-
-  it("grant -> withdraw -> grant leaves three rows, newest granted", async () => {
-    await settings("share_data", true);
-    await settings("share_data", false);
-    await settings("share_data", true);
-    expect(ledger.map((r) => r.granted)).toEqual([true, false, true]);
-    expect(newest(ledger, "share_data")?.source).toBe("account_settings");
-  });
-
-  it("writes nothing for a repeat of the same answer", async () => {
-    await settings("share_data", true);
-    const again = await settings("share_data", true);
-    expect(again).toEqual({ ok: true, changed: false });
-    expect(ledger).toHaveLength(1);
-  });
-
-  it("treats a preference as on until withdrawn: granting it first writes nothing", async () => {
-    expect(await settings("product_news", true)).toEqual({
-      ok: true,
-      changed: false,
-    });
-    expect(ledger).toHaveLength(0);
-    expect(await settings("product_news", false)).toEqual({
-      ok: true,
-      changed: true,
-    });
-    expect(ledger).toHaveLength(1);
-  });
-
-  it("records the statement the registry resolves, never one from the caller", async () => {
-    await settings("share_data", true);
-    const purpose = CONFIG.purposes.find((p) => p.id === "share_data")!;
-    expect(ledger[0]?.["statement"]).toBe(
-      resolveConsentStatement(purpose, "en").statement,
-    );
-  });
-
-  it("asks an agreement once per policy version and refuses to withdraw it", async () => {
-    expect(await settings("service_terms", true)).toEqual({
-      ok: true,
-      changed: true,
-    });
-    expect(await settings("service_terms", true)).toEqual({
-      ok: true,
-      changed: false,
-    });
-    expect(await settings("service_terms", false)).toEqual({
-      ok: false,
-      code: "agreement_not_withdrawable",
-    });
-    expect(ledger).toHaveLength(1);
-  });
-
-  it("re-asks an agreement when its policy version is bumped", async () => {
-    await settings("service_terms", true);
-    const bumped = siteConsentConfigSchema.parse({
-      ...CONFIG,
-      purposes: CONFIG.purposes.map((p) =>
-        p.id === "service_terms" ? { ...p, policyVersion: 2 } : p,
-      ),
-    });
-    const result = await recordPersonConsent({
-      ...base,
-      config: bumped,
-      purposeId: "service_terms",
-      granted: true,
-      source: "account_settings",
-    });
-    expect(result).toEqual({ ok: true, changed: true });
-    expect(newest(ledger, "service_terms")?.policyVersion).toBe(2);
-  });
-
-  it("refuses an unknown purpose and the cookie purpose", async () => {
-    expect(await settings("nope", true)).toEqual({
-      ok: false,
-      code: "purpose_unknown",
-    });
-    expect(await settings("analytics_cookies", true)).toEqual({
-      ok: false,
-      code: "cookie_purpose",
-    });
-    expect(ledger).toHaveLength(0);
-  });
-
-  it("takes the (subject, purpose) advisory lock before it reads", async () => {
-    await settings("share_data", true);
-    const lock = (prisma.$executeRaw as jest.Mock).mock.calls[0]!;
-    expect(String(lock[0].join("?"))).toContain("pg_advisory_xact_lock");
-    expect(lock[1]).toBe(`ailk:consent:${WS}:person:${PERSON}:share_data`);
-  });
-
-  it("an unsubscribe withdraws a grant an anonymous form made, and only once", async () => {
-    // A magnet row the person never confirmed themself: own reading says
-    // 'not granted', any-source says granted.
-    ledger.push({
-      id: "cnsnt_00000000-0000-7000-8000-0000000000f1",
-      workspaceId: WS,
-      subjectType: "lead",
-      subjectId: "lead_1",
-      personId: PERSON,
-      purposeId: "share_data",
-      granted: true,
-      source: "magnet",
-      sourceRef: "free-guide",
-      policyVersion: 1,
-      locale: "en",
-      statement: "Share usage data.",
-      createdAt: new Date("2026-10-12T00:00:00Z"),
-    });
-    const first = await recordPersonConsent({
-      ...base,
-      purposeId: "share_data",
-      granted: false,
-      source: "email_unsubscribe",
-    });
-    const second = await recordPersonConsent({
-      ...base,
-      purposeId: "share_data",
-      granted: false,
-      source: "email_unsubscribe",
-    });
-    expect(first).toEqual({ ok: true, changed: true });
-    expect(second).toEqual({ ok: true, changed: false });
-    expect(ledger.filter((r) => r.source === "email_unsubscribe")).toHaveLength(
-      1,
-    );
-  });
-
-  it("an unsubscribe still withdraws an own grant that a newer anonymous decline hides", async () => {
-    await settings("share_data", true);
-    ledger.push({
-      id: "cnsnt_00000000-0000-7000-8000-0000000000f2",
-      workspaceId: WS,
-      subjectType: "lead",
-      subjectId: "lead_2",
-      personId: PERSON,
-      purposeId: "share_data",
-      granted: false,
-      source: "magnet",
-      sourceRef: "free-guide",
-      policyVersion: 1,
-      locale: "en",
-      statement: "Share usage data.",
-      createdAt: new Date(Date.now() + 60_000),
-    });
-    const result = await recordPersonConsent({
-      ...base,
-      purposeId: "share_data",
-      granted: false,
-      source: "email_unsubscribe",
-    });
-    expect(result).toEqual({ ok: true, changed: true });
-    expect(ledger.filter((r) => r.source === "email_unsubscribe")).toHaveLength(
-      1,
-    );
-  });
-
-  it("writes the owner's platform consents against subject user with no Person", async () => {
-    const result = await recordPersonConsent({
-      workspaceId: WS,
-      personId: null,
-      purposeId: "wt_product_data",
-      granted: true,
-      source: "account_settings",
-      locale: "en",
-      config: PLATFORM_CONSENT_CONFIG,
-      subject: { subjectType: "user", subjectId: "user_1" },
-    });
-    expect(result).toEqual({ ok: true, changed: true });
-    expect(ledger[0]).toMatchObject({ subjectType: "user", personId: null });
-  });
-});
-
-describe("recordCookieChoice (#8438 D3)", () => {
-  const choice = (c: "accepted" | "declined") =>
-    recordCookieChoice(
-      { workspaceId: WS, visitorId: VISITOR, choice: c, locale: "en" },
-      CONFIG,
-    );
-
-  it("writes one visitor row stamped with the banner source and the registry statement", async () => {
-    expect(await choice("accepted")).toEqual({ recorded: true });
-    expect(ledger).toHaveLength(1);
-    expect(ledger[0]).toMatchObject({
-      subjectType: "visitor",
-      subjectId: VISITOR,
-      purposeId: "analytics_cookies",
-      granted: true,
-      source: "cookie_banner",
-      policyVersion: 1,
-      personId: null,
-    });
-  });
-
-  it("logs a change of choice and not a replay", async () => {
-    await choice("accepted");
-    expect(await choice("accepted")).toEqual({ recorded: false });
-    expect(await choice("declined")).toEqual({ recorded: true });
-    expect(ledger.map((r) => r.granted)).toEqual([true, false]);
-  });
-
-  it("writes nothing when the registry declares no cookie purpose", async () => {
-    const none = siteConsentConfigSchema.parse({
-      policies: {},
-      purposes: [{ id: "a", label: { en: "a" } }],
-    });
-    expect(
-      await recordCookieChoice(
-        {
-          workspaceId: WS,
-          visitorId: VISITOR,
-          choice: "accepted",
-          locale: "en",
-        },
-        none,
-      ),
-    ).toEqual({ recorded: false });
-    expect(ledger).toHaveLength(0);
-  });
-
-  it("uses the platform default registry when none is passed", async () => {
-    expect(
-      await recordCookieChoice({
-        workspaceId: WS,
-        visitorId: VISITOR,
-        choice: "declined",
-        locale: "en",
-      }),
-    ).toEqual({ recorded: true });
-    expect(ledger[0]?.["purposeId"]).toBe(
-      SITE_CONSENT_CONFIG_DEFAULTS.purposes.find((p) => p.area === "cookies")
-        ?.id,
-    );
-  });
-});
-
-describe("linkConsentVisitor (#8438 C5)", () => {
-  it("inserts and ignores a duplicate", async () => {
-    (prisma.consentVisitorLink.createMany as jest.Mock).mockResolvedValue({
-      count: 1,
-    });
-    await linkConsentVisitor({
-      workspaceId: WS,
-      visitorId: VISITOR,
-      personId: PERSON,
-      source: "magnet",
-    });
-    expect(prisma.consentVisitorLink.createMany).toHaveBeenCalledWith({
-      data: [
-        {
-          workspaceId: WS,
-          visitorId: VISITOR,
-          personId: PERSON,
-          source: "magnet",
-        },
-      ],
-      skipDuplicates: true,
-    });
-  });
-
-  it("never throws: a failure is swallowed so a link cannot fail a lead", async () => {
-    (prisma.consentVisitorLink.createMany as jest.Mock).mockRejectedValue(
-      new Error("down"),
-    );
-    await expect(
-      linkConsentVisitor({
-        workspaceId: WS,
-        visitorId: VISITOR,
-        personId: PERSON,
-        source: "api",
-      }),
-    ).resolves.toBeUndefined();
-  });
-});
-
-describe("the unsubscribe token (#8438 D3, SEC-8438-9)", () => {
-  const SECRET = "x".repeat(40);
-  const claims = {
-    workspaceId: WS,
-    personId: PERSON,
-    purposeId: "product_news",
-  };
-  let saved: string | undefined;
-
-  beforeEach(() => {
-    saved = process.env["AILK_CONSENT_LINK_SECRET"];
-    process.env["AILK_CONSENT_LINK_SECRET"] = SECRET;
-  });
-  afterEach(() => {
-    if (saved === undefined) delete process.env["AILK_CONSENT_LINK_SECRET"];
-    else process.env["AILK_CONSENT_LINK_SECRET"] = saved;
-  });
-
-  it("round-trips and has the v1.<payload>.<mac> shape", () => {
-    const token = consentUnsubscribeToken(claims);
-    expect(token).toMatch(/^v1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/);
-    expect(verifyConsentUnsubscribeToken(token)).toEqual(claims);
-  });
-
-  it("refuses a token with one flipped character", () => {
-    const token = consentUnsubscribeToken(claims);
-    const flipped = token.slice(0, -1) + (token.endsWith("A") ? "B" : "A");
-    expect(verifyConsentUnsubscribeToken(flipped)).toBeNull();
-    const body = token.split(".");
-    body[1] = body[1]!.slice(0, -1) + (body[1]!.endsWith("A") ? "B" : "A");
-    expect(verifyConsentUnsubscribeToken(body.join("."))).toBeNull();
-  });
-
-  it("refuses a token older than 400 days, and a future-dated one", () => {
-    const now = new Date("2026-10-12T00:00:00Z");
-    const old = consentUnsubscribeToken(
-      claims,
-      new Date(now.getTime() - 401 * 86_400_000),
-    );
-    const fresh = consentUnsubscribeToken(
-      claims,
-      new Date(now.getTime() - 399 * 86_400_000),
-    );
-    const future = consentUnsubscribeToken(
-      claims,
-      new Date(now.getTime() + 3_600_000),
-    );
-    expect(verifyConsentUnsubscribeToken(old, now)).toBeNull();
-    expect(verifyConsentUnsubscribeToken(fresh, now)).toEqual(claims);
-    expect(verifyConsentUnsubscribeToken(future, now)).toBeNull();
-  });
-
-  it("refuses a wrong version, garbage, and a token signed with another secret", () => {
-    const token = consentUnsubscribeToken(claims);
-    expect(
-      verifyConsentUnsubscribeToken(token.replace(/^v1/, "v2")),
-    ).toBeNull();
-    expect(verifyConsentUnsubscribeToken("nonsense")).toBeNull();
-    expect(verifyConsentUnsubscribeToken("a.b.c")).toBeNull();
-    process.env["AILK_CONSENT_LINK_SECRET"] = "y".repeat(40);
-    expect(verifyConsentUnsubscribeToken(token)).toBeNull();
-  });
-
-  it("throws on mint, and refuses on verify, with the secret unset or under 32 bytes", () => {
-    const token = consentUnsubscribeToken(claims);
-    delete process.env["AILK_CONSENT_LINK_SECRET"];
-    expect(consentLinkSecretConfigured()).toBe(false);
-    expect(() => consentUnsubscribeToken(claims)).toThrow(
-      ConsentLinkSecretMissing,
-    );
-    expect(verifyConsentUnsubscribeToken(token)).toBeNull();
-    process.env["AILK_CONSENT_LINK_SECRET"] = "short";
-    expect(consentLinkSecretConfigured()).toBe(false);
-    expect(() => consentUnsubscribeToken(claims)).toThrow(
-      ConsentLinkSecretMissing,
-    );
-  });
-});

package/templates/apps/api/src/services/__tests__/consent-migration.test.ts

@@ -1,65 +0,0 @@
-/**
- * @file consent-migration.test.ts
- * @description Drift guard between the consent_grants migration's BACKFILL
- * and the consent service (#5275, spec §5.1 last bullet + §5.3 second
- * boundary): every pre-existing listing gets one grant marked
- * wording-UNRECOVERABLE — the exact `UNRECOVERABLE_CONSENT_STATEMENT`
- * literal, so a later reader can match it — stamped at the listing's own
- * consent_at, and project_listings itself is never touched.
- */
-import { readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
-
-import { SITE_CONSENT_CONFIG_DEFAULTS } from "@working-theory/validation";
-
-import { UNRECOVERABLE_CONSENT_STATEMENT } from "../consent";
-
-const MIGRATION = join(
-  resolve(__dirname, "..", "..", "..", "..", ".."),
-  "database",
-  "migrations",
-  "20260911180000_consent_grants",
-  "migration.sql",
-);
-
-describe("consent_grants migration backfill (#5275 D11)", () => {
-  const sql = readFileSync(MIGRATION, "utf-8");
-
-  it("creates the table with its two indexes", () => {
-    expect(sql).toContain('CREATE TABLE "consent_grants"');
-    expect(sql).toContain('("site_id", "subject_type", "subject_id")');
-    expect(sql).toContain('("site_id", "purpose_id")');
-  });
-
-  it("inserts one row per pre-existing project_listings row", () => {
-    expect(sql).toContain('INSERT INTO "consent_grants"');
-    expect(sql).toMatch(/FROM "project_listings"/);
-    expect(sql).toContain("'project_listing'");
-    expect(sql).toContain("'service_terms'");
-  });
-
-  it("marks every backfilled row with the exact unrecoverable sentinel and a COMPUTED hash", () => {
-    expect(sql).toContain(`'${UNRECOVERABLE_CONSENT_STATEMENT}'`);
-    expect(sql).toContain(
-      `encode(sha256(convert_to('${UNRECOVERABLE_CONSENT_STATEMENT}', 'UTF8')), 'hex')`,
-    );
-    expect(sql).toContain("'und'");
-  });
-
-  it("sources created_at from the listing's own consent_at", () => {
-    const insert = sql.slice(sql.indexOf('INSERT INTO "consent_grants"'));
-    expect(insert).toContain('"consent_at"');
-    expect(insert).toContain('"created_at"');
-  });
-
-  it("never UPDATEs or ALTERs project_listings — consent_at stays as it was", () => {
-    expect(sql).not.toMatch(/UPDATE\s+"project_listings"/i);
-    expect(sql).not.toMatch(/ALTER\s+TABLE\s+"project_listings"/i);
-  });
-
-  it("never stamps today's default wording onto a grant nobody read", () => {
-    expect(sql).not.toContain("You agree to being contacted");
-    const defaultStatement = SITE_CONSENT_CONFIG_DEFAULTS.purposes[0]!.label["en"]!;
-    expect(sql).not.toContain(defaultStatement);
-  });
-});