create-ailk 0.23.0 → 0.25.1

package/templates/database/__tests__/consent-ledger.db.test.ts

@@ -1,345 +0,0 @@
-/**
- * @file consent-ledger.db.test.ts
- *
- * LIVE-DATABASE proof of the consent ledger (#8438, spec
- * docs/specs/8438-consent-registry-and-ledger-step-spec.md D2, AC-2). Requires
- * DATABASE_URL pointing at a Postgres with the migrations applied — the suite
- * SKIPS when DATABASE_URL is unset, keeping the workspace Jest run DB-free
- * (the repo convention; the `apps/api Route Tests (Postgres)` workflow runs it).
- *
- * What it proves that a mock cannot:
- *   1. consent_grants and consent_visitor_links refuse UPDATE, DELETE and
- *      TRUNCATE, each raising `<table> is append-only`.
- *   2. A new ledger row must name its source and, unless legacy, its policy
- *      version; the source vocabulary is closed.
- *   3. A row stored before the ledger reads source = 'legacy' (written here
- *      the only way the table allows) and the column has no default for a
- *      writer that forgets.
- *   4. consent_visitor_links takes only a v4 UUID visitor id, ignores a
- *      repeat link, and carries no network or browser evidence column.
- *
- * Rows are append-only, so this suite cannot clean up after itself: every run
- * stamps fresh workspace and person ids and leaves its rows behind.
- */
-import { randomUUID } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-
-import { Client } from "pg";
-
-const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
-
-/** A well-formed `<prefix>_<uuid v7-shaped>` id, fresh per call. */
-function id(prefix: string): string {
-  const hex = randomUUID().replace(/-/g, "");
-  return `${prefix}_${hex.slice(0, 8)}-${hex.slice(8, 12)}-7${hex.slice(13, 16)}-8${hex.slice(17, 20)}-${hex.slice(20, 32)}`;
-}
-
-describeDb("the consent ledger (#8438 D2, AC-2, live DB)", () => {
-  let db: Client;
-  const WS = id("wksp");
-  const PERSON = id("person");
-  const VISITOR = randomUUID();
-
-  beforeAll(async () => {
-    db = new Client({ connectionString: process.env.DATABASE_URL });
-    await db.connect();
-  });
-
-  afterAll(async () => {
-    await db.end();
-  });
-
-  const insertGrant = (
-    cols: {
-      source?: string | null;
-      policyVersion?: number | null;
-      personId?: string | null;
-      omitSource?: boolean;
-    } = {},
-  ) => {
-    const names = [
-      "site_id",
-      "workspace_id",
-      "subject_type",
-      "subject_id",
-      "purpose_id",
-      "granted",
-      "locale",
-      "statement",
-      "statement_hash",
-      "person_id",
-      "policy_version",
-    ];
-    const values: unknown[] = [
-      WS,
-      WS,
-      "lead",
-      "lead_1",
-      "service_terms",
-      true,
-      "en",
-      "You agree.",
-      "hash",
-      cols.personId === undefined ? PERSON : cols.personId,
-      cols.policyVersion === undefined ? 1 : cols.policyVersion,
-    ];
-    if (!cols.omitSource) {
-      names.push("source");
-      values.push(cols.source === undefined ? "magnet" : cols.source);
-    }
-    const placeholders = values.map((_, i) => `$${i + 1}`).join(", ");
-    return db.query(
-      `INSERT INTO "consent_grants" (${names.map((n) => `"${n}"`).join(", ")}) VALUES (${placeholders}) RETURNING "id"`,
-      values,
-    );
-  };
-
-  const insertLink = (
-    cols: { visitorId?: string; source?: string; personId?: string } = {},
-  ) =>
-    db.query(
-      `INSERT INTO "consent_visitor_links" ("workspace_id", "visitor_id", "person_id", "source")
-       VALUES ($1, $2, $3, $4) RETURNING "id"`,
-      [
-        WS,
-        cols.visitorId ?? VISITOR,
-        cols.personId ?? PERSON,
-        cols.source ?? "magnet",
-      ],
-    );
-
-  describe("consent_grants", () => {
-    it("accepts a row that names its source and policy version", async () => {
-      const result = await insertGrant({ source: "account_settings" });
-      expect(result.rows[0].id).toMatch(/^cnsnt_/);
-    });
-
-    it("refuses an UPDATE, a row DELETE and a TRUNCATE with `consent_grants is append-only`", async () => {
-      await insertGrant();
-      await expect(
-        db.query(`UPDATE "consent_grants" SET "granted" = NOT "granted"`),
-      ).rejects.toThrow(/consent_grants is append-only/);
-      await expect(db.query(`DELETE FROM "consent_grants"`)).rejects.toThrow(
-        /consent_grants is append-only/,
-      );
-      await expect(db.query(`TRUNCATE "consent_grants"`)).rejects.toThrow(
-        /consent_grants is append-only/,
-      );
-    });
-
-    it("refuses a new row with source 'magnet' and no policy_version", async () => {
-      await expect(
-        insertGrant({ source: "magnet", policyVersion: null }),
-      ).rejects.toThrow(/consent_grants_policy_version_present/);
-    });
-
-    it("refuses a source outside the vocabulary and a zero policy_version", async () => {
-      await expect(insertGrant({ source: "telepathy" })).rejects.toThrow(
-        /consent_grants_source_known/,
-      );
-      await expect(insertGrant({ policyVersion: 0 })).rejects.toThrow(
-        /consent_grants_policy_version_positive/,
-      );
-    });
-
-    it("has no default source: a writer that forgets is refused", async () => {
-      await expect(insertGrant({ omitSource: true })).rejects.toThrow(
-        /null value in column "source"/,
-      );
-    });
-
-    it("lets a legacy row carry no policy_version, and reads it back as legacy", async () => {
-      const legacyPerson = id("person");
-      await insertGrant({
-        source: "legacy",
-        policyVersion: null,
-        personId: legacyPerson,
-      });
-      const read = await db.query(
-        `SELECT "source", "policy_version" FROM "consent_grants" WHERE "person_id" = $1`,
-        [legacyPerson],
-      );
-      expect(read.rows).toEqual([{ source: "legacy", policy_version: null }]);
-    });
-
-    it("refuses a person_id that is not a person id", async () => {
-      await expect(insertGrant({ personId: "someone" })).rejects.toThrow(
-        /consent_grants_person_id_format/,
-      );
-    });
-  });
-
-  describe("consent_visitor_links", () => {
-    it("accepts a link and ignores a repeat of it", async () => {
-      await insertLink();
-      const again = await db.query(
-        `INSERT INTO "consent_visitor_links" ("workspace_id", "visitor_id", "person_id", "source")
-         VALUES ($1, $2, $3, 'magnet') ON CONFLICT DO NOTHING`,
-        [WS, VISITOR, PERSON],
-      );
-      expect(again.rowCount).toBe(0);
-    });
-
-    it("refuses an UPDATE, a row DELETE and a TRUNCATE with `consent_visitor_links is append-only`", async () => {
-      await expect(
-        db.query(`UPDATE "consent_visitor_links" SET "source" = 'api'`),
-      ).rejects.toThrow(/consent_visitor_links is append-only/);
-      await expect(
-        db.query(`DELETE FROM "consent_visitor_links"`),
-      ).rejects.toThrow(/consent_visitor_links is append-only/);
-      await expect(
-        db.query(`TRUNCATE "consent_visitor_links"`),
-      ).rejects.toThrow(/consent_visitor_links is append-only/);
-    });
-
-    it("refuses a visitor id that is not a v4 UUID, a bad source and a bad person id", async () => {
-      await expect(
-        insertLink({ visitorId: "01920000-8168-7000-8000-0000000000b1" }),
-      ).rejects.toThrow(/consent_visitor_links_visitor_id_format/);
-      await expect(insertLink({ visitorId: "visitor-1" })).rejects.toThrow(
-        /consent_visitor_links_visitor_id_format/,
-      );
-      await expect(
-        insertLink({ visitorId: randomUUID(), source: "cookie_banner" }),
-      ).rejects.toThrow(/consent_visitor_links_source_known/);
-      await expect(
-        insertLink({ visitorId: randomUUID(), personId: "nobody" }),
-      ).rejects.toThrow(/consent_visitor_links_person_id_format/);
-    });
-
-    it("gives the table an id with the registered cvlink prefix", async () => {
-      const result = await insertLink({ visitorId: randomUUID() });
-      expect(result.rows[0].id).toMatch(/^cvlink_/);
-    });
-  });
-
-  describe("the store's own SQL against this database (SEC-8438-2 flood case)", () => {
-    /**
-     * Pull one `$queryRaw` template out of `apps/api/src/lib/consent-store.ts`
-     * and number its `${…}` holes, so the very SQL the API runs is what this
-     * suite runs: the readers cannot drift from what is proved here.
-     */
-    function storeSql(fn: string, nth = 0): { text: string; holes: string[] } {
-      const source = readFileSync(
-        join(__dirname, "../../apps/api/src/lib/consent-store.ts"),
-        "utf8",
-      );
-      const start = source.indexOf(`export async function ${fn}(`);
-      expect(start).toBeGreaterThan(-1);
-      let open = source.indexOf("$queryRaw", start);
-      for (let i = 0; i < nth; i += 1) open = source.indexOf("$queryRaw", open + 1);
-      const tick = source.indexOf("`", open);
-      const end = source.indexOf("`", tick + 1);
-      const holes: string[] = [];
-      const text = source
-        .slice(tick + 1, end)
-        .replace(/\$\{([^}]+)\}/g, (_match, expr: string) => {
-          let at = holes.indexOf(expr);
-          if (at === -1) {
-            holes.push(expr);
-            at = holes.length - 1;
-          }
-          return `$${at + 1}`;
-        });
-      return { text, holes };
-    }
-    function runStore(fn: string, values: Record<string, unknown>, nth = 0) {
-      const { text, holes } = storeSql(fn, nth);
-      return db.query(
-        text,
-        holes.map((hole) => values[hole]),
-      );
-    }
-
-    it("a Person's withdrawal survives 600 magnet grants and 600 linked-visitor cookie rows, and every row pages out once", async () => {
-      const ws = id("wksp");
-      const person = id("person");
-      const visitor = randomUUID();
-      const insertMany = (cols: {
-        n: number;
-        subjectType: string;
-        subjectId: string;
-        personId: string | null;
-        granted: boolean;
-        source: string;
-      }) =>
-        db.query(
-          `INSERT INTO "consent_grants"
-             ("site_id", "workspace_id", "subject_type", "subject_id", "purpose_id", "granted",
-              "locale", "statement", "statement_hash", "person_id", "source", "policy_version")
-           SELECT $1, $1, $2, $3, 'share_data', $4, 'en', 'Share usage data.', 'h', $5, $6, 1
-           FROM generate_series(1, $7::int)`,
-          [ws, cols.subjectType, cols.subjectId, cols.granted, cols.personId, cols.source, cols.n],
-        );
-
-      await insertMany({
-        n: 1,
-        subjectType: "person",
-        subjectId: person,
-        personId: person,
-        granted: false,
-        source: "account_settings",
-      });
-      await db.query(
-        `INSERT INTO "consent_visitor_links" ("workspace_id", "visitor_id", "person_id", "source")
-         VALUES ($1, $2, $3, 'magnet')`,
-        [ws, visitor, person],
-      );
-      await insertMany({
-        n: 600,
-        subjectType: "lead",
-        subjectId: "lead_1",
-        personId: person,
-        granted: true,
-        source: "magnet",
-      });
-      await insertMany({
-        n: 600,
-        subjectType: "visitor",
-        subjectId: visitor,
-        personId: null,
-        granted: true,
-        source: "cookie_banner",
-      });
-
-      // The OWN reading: still withdrawn.
-      const own = await runStore("ownConsentRows", { workspaceId: ws, personId: person });
-      expect(own.rows.map((r) => [r.purposeId, r.granted, r.source])).toEqual([
-        ["share_data", false, "account_settings"],
-      ]);
-
-      // The ANY-SOURCE reading: a flood row is newest, granted, and unverified.
-      const any = await runStore("anySourceConsentRows", { workspaceId: ws, personId: person });
-      expect(any.rows).toHaveLength(1);
-      expect(any.rows[0].granted).toBe(true);
-      expect(["magnet", "cookie_banner"]).toContain(any.rows[0].source);
-
-      // History: 1,201 rows, 500 a page, each exactly once.
-      const seen: string[] = [];
-      let cursor: string | null = null;
-      for (let pages = 0; pages < 5; pages += 1) {
-        const page = await runStore("personConsentHistory", {
-          workspaceId: ws,
-          personId: person,
-          cursorId: cursor,
-          "CONSENT_HISTORY_PAGE_SIZE + 1": 501,
-          // the page query is the function's second `$queryRaw`
-        }, 1);
-        const rows = page.rows.slice(0, 500);
-        seen.push(...rows.map((r) => r.id as string));
-        if (page.rows.length <= 500) break;
-        cursor = rows[rows.length - 1].id as string;
-      }
-      expect(seen).toHaveLength(1201);
-      expect(new Set(seen).size).toBe(1201);
-
-      // Another workspace's reading of the same Person sees nothing.
-      const elsewhere = await runStore("anySourceConsentRows", {
-        workspaceId: id("wksp"),
-        personId: person,
-      });
-      expect(elsewhere.rows).toHaveLength(0);
-    });
-  });
-});

package/templates/database/__tests__/consent-source-checkout-migration.test.ts

@@ -1,79 +0,0 @@
-/**
- * @file consent-source-checkout-migration.test.ts
- *
- * DB-free proof of the consent_source_checkout migration's shape (#8765, spec
- * docs/specs/8765-sign-up-refuses-without-the-spec.md D13, AC-8). Reads the
- * migration's own text: it drops `consent_grants_source_known` and re-adds it
- * `NOT VALID` with exactly the values of `CONSENT_SOURCES`, then `VALIDATE`s
- * it — with no `UPDATE`, `INSERT` or `DELETE`, so the append-only ledger is
- * never written.
- */
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-
-import { CONSENT_SOURCES } from "@working-theory/validation";
-
-const MIGRATION = join(
-  __dirname,
-  "..",
-  "migrations",
-  "20261019120000_consent_source_checkout",
-  "migration.sql",
-);
-
-/** The migration's statements, comments stripped, whitespace collapsed. */
-function statements(): string[] {
-  const text = readFileSync(MIGRATION, "utf8")
-    .split("\n")
-    .filter((line) => !line.trimStart().startsWith("--"))
-    .join("\n");
-  return text
-    .split(";")
-    .map((s) => s.replace(/\s+/g, " ").trim())
-    .filter((s) => s.length > 0);
-}
-
-describe("the consent_source_checkout migration (#8765 D13, AC-8)", () => {
-  it("drops the source CHECK, re-adds it NOT VALID, then VALIDATEs it — nothing else", () => {
-    const shapes = statements().map((s) => {
-      if (
-        s ===
-        'ALTER TABLE "consent_grants" DROP CONSTRAINT "consent_grants_source_known"'
-      ) {
-        return "drop";
-      }
-      if (
-        /^ALTER TABLE "consent_grants" ADD CONSTRAINT "consent_grants_source_known" CHECK \(.*\) NOT VALID$/.test(
-          s,
-        )
-      ) {
-        return "add";
-      }
-      if (
-        s ===
-        'ALTER TABLE "consent_grants" VALIDATE CONSTRAINT "consent_grants_source_known"'
-      ) {
-        return "validate";
-      }
-      return `unexpected: ${s}`;
-    });
-    expect(shapes).toEqual(["drop", "add", "validate"]);
-  });
-
-  it("names exactly the eight values of CONSENT_SOURCES, checkout among them", () => {
-    const add = statements().find((s) => s.includes("ADD CONSTRAINT"));
-    const list = add?.match(/CHECK \("source" IN \(([^)]*)\)\)/)?.[1];
-    expect(list).toBeDefined();
-    const values = (list ?? "")
-      .split(",")
-      .map((v) => v.trim().replace(/^'|'$/g, ""));
-    expect(values).toHaveLength(8);
-    expect([...values].sort()).toEqual([...CONSENT_SOURCES].sort());
-    expect(values).toContain("checkout");
-  });
-
-  it("writes no row: no UPDATE, INSERT or DELETE", () => {
-    for (const s of statements())
-      expect(s).not.toMatch(/\b(UPDATE|INSERT|DELETE)\b/i);
-  });
-});