create-ailk 0.23.0 → 0.25.1

package/templates/apps/api/src/__tests__/support/hub-sign-in-fake-db.ts

@@ -1,362 +0,0 @@
-/**
- * An in-memory stand-in for the handful of Prisma delegates the hub sign-in
- * flow touches (#7894): `spoke`, `oAuthClient`, `oAuthAuthorization`,
- * `verification` and `user`. Test-only.
- *
- * It lets the suites drive the REAL store, service, routes and preHandler end
- * to end — a code minted by one call is consumed (once) by the next — while
- * the Prisma client itself, the external boundary, stays faked. Every delegate
- * method answers only the `where` shapes the production code uses; an
- * unexpected shape throws, so a code change that adds a query is a failing
- * test and not a silent miss.
- *
- * Install it on the shared `__mocks__/prisma.ts` double:
- *
- *   jest.mock("../../lib/prisma.js");
- *   const fake = installHubSignInFakeDb(jest.mocked(prisma));
- */
-import { randomUUID } from "node:crypto";
-
-import { hashSpokeKey, mintSpokeKey } from "../../lib/spoke-store.js";
-import {
-  HUB_CALLBACK_PATH,
-  mintClientSecret,
-  sha256Hex,
-} from "../../lib/hub-sign-in-store.js";
-
-type Row = Record<string, unknown>;
-type Where = Record<string, unknown>;
-
-export interface FakeUser {
-  id: string;
-  name: string | null;
-  email: string;
-  emailVerified: boolean;
-  createdAt: Date;
-}
-
-export interface FakeSpoke {
-  id: string;
-  workspaceId: string;
-  name: string;
-  credentialHash: string;
-  revokedAt: Date | null;
-}
-
-export interface FakeClient {
-  id: string;
-  clientId: string;
-  clientSecret: string;
-  redirectUris: string[];
-  enabled: boolean;
-}
-
-export interface FakeVerification {
-  id: string;
-  identifier: string;
-  value: string;
-  expiresAt: Date;
-}
-
-export interface FakeAuthorization {
-  id: string;
-  userId: string;
-  clientId: string;
-  scopes: string[];
-  accessToken: string;
-  expiresAt: Date;
-  revokedAt: Date | null;
-}
-
-export interface FakeHubDb {
-  users: Map<string, FakeUser>;
-  spokes: Map<string, FakeSpoke>;
-  clients: Map<string, FakeClient>;
-  verifications: FakeVerification[];
-  authorizations: FakeAuthorization[];
-  /** Every `prisma.session.*` call — the token route must make none. */
-  sessionCalls: string[];
-}
-
-/** A seeded spoke with a registered sign-in client. */
-export interface SeededSpoke {
-  spoke: FakeSpoke;
-  client: FakeClient;
-  /** The spoke key, in clear (the test sends it). */
-  key: string;
-  /** The client secret, in clear. */
-  secret: string;
-  redirectUri: string;
-  /** `Authorization: Basic …` for the token and revoke routes. */
-  basic: string;
-}
-
-function eq(row: object, where: Where): boolean {
-  return Object.entries(where).every(([key, expected]) => {
-    if (expected !== null && typeof expected === "object") {
-      throw new Error(`fake db: unsupported where clause on "${key}"`);
-    }
-    return (row as Record<string, unknown>)[key] === expected;
-  });
-}
-
-function pickWhere(where: Where, allowed: string[]): void {
-  for (const key of Object.keys(where)) {
-    if (!allowed.includes(key)) {
-      throw new Error(`fake db: unexpected where key "${key}"`);
-    }
-  }
-}
-
-type DelegateMock = {
-  mockImplementation: (fn: (arg: never) => unknown) => void;
-};
-
-function impl(mock: unknown, fn: (arg: never) => unknown): void {
-  (mock as DelegateMock).mockImplementation(fn);
-}
-
-export function installHubSignInFakeDb(db: {
-  spoke: { findUnique: unknown };
-  oAuthClient: { findUnique: unknown; upsert: unknown; updateMany: unknown };
-  oAuthAuthorization: {
-    findUnique: unknown;
-    upsert: unknown;
-    updateMany: unknown;
-  };
-  verification: { create: unknown; findFirst: unknown; deleteMany: unknown };
-  user: { findUnique: unknown };
-  session: { findUnique: unknown; create: unknown };
-}): FakeHubDb {
-  const state: FakeHubDb = {
-    users: new Map(),
-    spokes: new Map(),
-    clients: new Map(),
-    verifications: [],
-    authorizations: [],
-    sessionCalls: [],
-  };
-
-  impl(
-    db.user.findUnique,
-    async ({ where }: { where: Where }) =>
-      state.users.get(String(where.id)) ?? null,
-  );
-
-  impl(db.spoke.findUnique, async ({ where }: { where: Where }) => {
-    pickWhere(where, ["id", "credentialHash"]);
-    for (const spoke of state.spokes.values()) {
-      if (eq(spoke, where)) return spoke;
-    }
-    return null;
-  });
-
-  impl(db.oAuthClient.findUnique, async ({ where }: { where: Where }) => {
-    pickWhere(where, ["clientId"]);
-    return state.clients.get(String(where.clientId)) ?? null;
-  });
-
-  impl(
-    db.oAuthClient.upsert,
-    async (args: {
-      where: Where;
-      create: Omit<FakeClient, "id">;
-      update: Partial<FakeClient>;
-    }) => {
-      const clientId = String(args.where.clientId);
-      const existing = state.clients.get(clientId);
-      const next: FakeClient = existing
-        ? { ...existing, ...args.update }
-        : { id: `oauthc_${randomUUID()}`, ...args.create };
-      state.clients.set(clientId, next);
-      return next;
-    },
-  );
-
-  impl(
-    db.oAuthClient.updateMany,
-    async ({ where, data }: { where: Where; data: Row }) => {
-      pickWhere(where, ["clientId"]);
-      const client = state.clients.get(String(where.clientId));
-      if (!client) return { count: 0 };
-      Object.assign(client, data);
-      return { count: 1 };
-    },
-  );
-
-  impl(
-    db.verification.create,
-    async ({ data }: { data: Omit<FakeVerification, "id"> }) => {
-    const row: FakeVerification = { id: `verify_${randomUUID()}`, ...data };
-    state.verifications.push(row);
-    return row;
-  });
-
-  impl(db.verification.findFirst, async ({ where }: { where: Where }) => {
-    pickWhere(where, ["identifier"]);
-    return (
-      state.verifications.find((v) => v.identifier === where.identifier) ?? null
-    );
-  });
-
-  impl(db.verification.deleteMany, async ({ where }: { where: Where }) => {
-    const before = state.verifications.length;
-    if (typeof where.id === "string") {
-      state.verifications = state.verifications.filter(
-        (v) => v.id !== where.id,
-      );
-    } else {
-      const startsWith = (where.identifier as { startsWith: string })
-        .startsWith;
-      const lte = (where.expiresAt as { lte: Date }).lte;
-      state.verifications = state.verifications.filter(
-        (v) => !(v.identifier.startsWith(startsWith) && v.expiresAt <= lte),
-      );
-    }
-    return { count: before - state.verifications.length };
-  });
-
-  impl(
-    db.oAuthAuthorization.upsert,
-    async (args: {
-      where: { userId_clientId: { userId: string; clientId: string } };
-      create: Omit<FakeAuthorization, "id" | "revokedAt">;
-      update: Partial<FakeAuthorization>;
-    }) => {
-      const { userId, clientId } = args.where.userId_clientId;
-      const existing = state.authorizations.find(
-        (a) => a.userId === userId && a.clientId === clientId,
-      );
-      if (existing) {
-        Object.assign(existing, args.update);
-        return existing;
-      }
-      const row: FakeAuthorization = {
-        id: `oautha_${randomUUID()}`,
-        revokedAt: null,
-        ...args.create,
-      };
-      state.authorizations.push(row);
-      return row;
-    },
-  );
-
-  impl(
-    db.oAuthAuthorization.updateMany,
-    async ({ where, data }: { where: Where; data: Row }) => {
-      // Two production shapes: the revoke route (a client's credential by
-      // digest) and the web app's password reset (every live grant of a user).
-      const matches = state.authorizations.filter((a) => {
-        if ("accessToken" in where && a.accessToken !== where.accessToken)
-          return false;
-        if ("clientId" in where && a.clientId !== where.clientId) return false;
-        if ("userId" in where && a.userId !== where.userId) return false;
-        if ("revokedAt" in where && a.revokedAt !== where.revokedAt)
-          return false;
-        return true;
-      });
-      for (const row of matches) Object.assign(row, data);
-      return { count: matches.length };
-    },
-  );
-
-  impl(
-    db.oAuthAuthorization.findUnique,
-    async ({ where }: { where: Where }) => {
-      pickWhere(where, ["accessToken"]);
-      const row = state.authorizations.find(
-        (a) => a.accessToken === where.accessToken,
-      );
-      if (!row) return null;
-      const client = [...state.clients.values()].find(
-        (c) => c.id === row.clientId,
-      );
-      const user = state.users.get(row.userId);
-      if (!client || !user) return null;
-      return {
-        userId: row.userId,
-        expiresAt: row.expiresAt,
-        revokedAt: row.revokedAt,
-        client: { clientId: client.clientId, enabled: client.enabled },
-        user: { emailVerified: user.emailVerified },
-      };
-    },
-  );
-
-  impl(db.session.findUnique, async () => {
-    state.sessionCalls.push("findUnique");
-    return null;
-  });
-  impl(db.session.create, async () => {
-    state.sessionCalls.push("create");
-    throw new Error("fake db: a hub sign-in must never create a Session");
-  });
-
-  return state;
-}
-
-let counter = 0;
-
-export function seedUser(
-  state: FakeHubDb,
-  overrides: Partial<FakeUser> = {},
-): FakeUser {
-  counter += 1;
-  const user: FakeUser = {
-    id: `user_${counter}`,
-    name: "Pat Person",
-    email: `pat${counter}@example.com`,
-    emailVerified: true,
-    createdAt: new Date("2026-10-01T00:00:00.000Z"),
-    ...overrides,
-  };
-  state.users.set(user.id, user);
-  return user;
-}
-
-export function seedSpoke(
-  state: FakeHubDb,
-  host = "spoke.example.com",
-): SeededSpoke {
-  counter += 1;
-  const key = mintSpokeKey();
-  const spoke: FakeSpoke = {
-    id: `spoke_${counter}`,
-    workspaceId: `wksp_${counter}`,
-    name: `Spoke ${counter}`,
-    credentialHash: hashSpokeKey(key),
-    revokedAt: null,
-  };
-  state.spokes.set(spoke.id, spoke);
-
-  const secret = mintClientSecret();
-  const redirectUri = `https://${host}${HUB_CALLBACK_PATH}`;
-  const client: FakeClient = {
-    id: `oauthc_${counter}`,
-    clientId: spoke.id,
-    clientSecret: sha256Hex(secret),
-    redirectUris: [redirectUri],
-    enabled: true,
-  };
-  state.clients.set(client.clientId, client);
-
-  return {
-    spoke,
-    client,
-    key,
-    secret,
-    redirectUri,
-    basic: `Basic ${Buffer.from(`${spoke.id}:${secret}`).toString("base64")}`,
-  };
-}
-
-/** A PKCE pair: the verifier a spoke generates and the S256 challenge of it. */
-export function pkcePair(): { verifier: string; challenge: string } {
-  const verifier = Buffer.from(randomUUID() + randomUUID())
-    .toString("base64url")
-    .slice(0, 64);
-  const challenge = Buffer.from(sha256Hex(verifier), "hex").toString(
-    "base64url",
-  );
-  return { verifier, challenge };
-}

package/templates/apps/api/src/bin/__tests__/rate-limit-probe.test.ts

@@ -1,184 +0,0 @@
-/**
- * @file rate-limit-probe.test.ts
- *
- * Unit tests for `runRateLimitProbe` (#5040 AC-10), with a stubbed `fetch`
- * and a no-op `sleep`. Each stub tracks per-identity call counts; the probe
- * itself picks its TEST-NET-3 addresses at random, so the stubs key their
- * behavior off "the first identity used" and "every other identity" rather
- * than a literal address.
- */
-import { runRateLimitProbe, type ProbeFetch } from "../../lib/rate-limit-probe.js";
-
-const ORIGIN = "https://example-deployment.vercel.app";
-const noopSleep = async () => undefined;
-
-function headerIdentity(init: { headers: Record<string, string> }): string {
-  return init.headers["x-forwarded-for"] ?? "unknown";
-}
-
-/** Limits every distinct identity independently to `limit` per window. */
-function perIdentityLimiter(limit: number): ProbeFetch {
-  const counts = new Map<string, number>();
-  return async (_url, init) => {
-    const id = headerIdentity(init);
-    const count = (counts.get(id) ?? 0) + 1;
-    counts.set(id, count);
-    return { status: count <= limit ? 200 : 429 };
-  };
-}
-
-/**
- * Limits ONLY the first identity used; every other identity always
- * succeeds (#5040 AC-10(d): "answers 200 to every burst request").
- */
-function firstIdentityOnlyLimiter(limit: number): ProbeFetch {
-  let firstId: string | undefined;
-  const counts = new Map<string, number>();
-  return async (_url, init) => {
-    const id = headerIdentity(init);
-    if (firstId === undefined) firstId = id;
-    if (id !== firstId) return { status: 200 };
-    const count = (counts.get(id) ?? 0) + 1;
-    counts.set(id, count);
-    return { status: count <= limit ? 200 : 429 };
-  };
-}
-
-/**
- * Limits the first identity and never lets ANY other identity through
- * either (#5040 AC-10(f): "answers 429 to every burst request").
- */
-function alwaysOverLimiter(limit: number): ProbeFetch {
-  let firstId: string | undefined;
-  const counts = new Map<string, number>();
-  return async (_url, init) => {
-    const id = headerIdentity(init);
-    if (firstId === undefined) firstId = id;
-    const count = (counts.get(id) ?? 0) + 1;
-    counts.set(id, count);
-    if (id === firstId) return { status: count <= limit ? 200 : 429 };
-    return { status: 429 };
-  };
-}
-
-describe("runRateLimitProbe (#5040 AC-10)", () => {
-  it("(a) a per-identity limiter gives xff: survives, burst: holds (10/30), exit 0", async () => {
-    const log = jest.fn();
-    const code = await runRateLimitProbe({
-      origin: ORIGIN,
-      fetch: perIdentityLimiter(10),
-      sleep: noopSleep,
-      log,
-    });
-    expect(code).toBe(0);
-    expect(log).toHaveBeenCalledWith("xff: survives");
-    expect(log).toHaveBeenCalledWith("burst: holds (10/30)");
-  });
-
-  it("(b) a shared, header-blind identity gives xff: overwritten, sleeps exactly once with 62000, exit 0", async () => {
-    let count = 0;
-    const fetch: ProbeFetch = async () => {
-      count += 1;
-      return { status: count <= 10 ? 200 : 429 };
-    };
-    const sleep = jest.fn(async (ms: number) => {
-      // Simulate the real window rolling over once the probe waits it out.
-      void ms;
-      count = 0;
-    });
-
-    const code = await runRateLimitProbe({
-      origin: ORIGIN,
-      fetch,
-      sleep,
-      log: jest.fn(),
-    });
-
-    expect(code).toBe(0);
-    expect(sleep).toHaveBeenCalledTimes(1);
-    expect(sleep).toHaveBeenCalledWith(62_000);
-  });
-
-  it("(c) a limiter that never answers 429 gives limiter: not-observed, exit 1", async () => {
-    const log = jest.fn();
-    const fetchAlways200: ProbeFetch = async () => ({ status: 200 });
-    const code = await runRateLimitProbe({
-      origin: ORIGIN,
-      fetch: fetchAlways200,
-      sleep: noopSleep,
-      log,
-    });
-    expect(code).toBe(1);
-    expect(log).toHaveBeenCalledWith("limiter: not-observed");
-  });
-
-  it("(d) only the first identity is limited, every other answers 200: burst: exceeded (30/30), exit 1", async () => {
-    const log = jest.fn();
-    const code = await runRateLimitProbe({
-      origin: ORIGIN,
-      fetch: firstIdentityOnlyLimiter(10),
-      sleep: noopSleep,
-      log,
-    });
-    expect(code).toBe(1);
-    expect(log).toHaveBeenCalledWith("xff: survives");
-    expect(log).toHaveBeenCalledWith("burst: exceeded (30/30)");
-  });
-
-  it("(e) --origin http://example.com is refused before any fetch call", async () => {
-    const fetch = jest.fn();
-    const log = jest.fn();
-    const code = await runRateLimitProbe({
-      origin: "http://example.com",
-      fetch,
-      sleep: noopSleep,
-      log,
-    });
-    expect(code).toBe(2);
-    expect(fetch).not.toHaveBeenCalled();
-    expect(log).toHaveBeenCalledWith("probe: error invalid-origin");
-  });
-
-  it("(f) every burst request answers 429: burst: inconclusive (0/30), exit 1", async () => {
-    const log = jest.fn();
-    const code = await runRateLimitProbe({
-      origin: ORIGIN,
-      fetch: alwaysOverLimiter(10),
-      sleep: noopSleep,
-      log,
-    });
-    expect(code).toBe(1);
-    expect(log).toHaveBeenCalledWith("burst: inconclusive (0/30)");
-  });
-
-  it("a loopback http origin is accepted", async () => {
-    const code = await runRateLimitProbe({
-      origin: "http://localhost:3002",
-      fetch: perIdentityLimiter(10),
-      sleep: noopSleep,
-      log: jest.fn(),
-    });
-    expect(code).toBe(0);
-  });
-
-  it("a network error during the burst answers probe: error <code>, exit 2", async () => {
-    const log = jest.fn();
-    let count = 0;
-    const fetch: ProbeFetch = async () => {
-      count += 1;
-      if (count <= 11) return { status: count <= 10 ? 200 : 429 };
-      if (count === 12) return { status: 200 }; // the xff probe (survives)
-      const err = new Error("boom") as Error & { code: string };
-      err.code = "ECONNRESET";
-      throw err;
-    };
-    const code = await runRateLimitProbe({
-      origin: ORIGIN,
-      fetch,
-      sleep: noopSleep,
-      log,
-    });
-    expect(code).toBe(2);
-    expect(log).toHaveBeenCalledWith("probe: error ECONNRESET");
-  });
-});

package/templates/apps/api/src/bin/abandon-sweep.ts

@@ -1,42 +0,0 @@
-#!/usr/bin/env node
-/* istanbul ignore file -- CLI bootstrap; the underlying runAbandonEmailSweep
-   logic is unit-tested in services/__tests__/abandon-email.test.ts. Mirrors
-   cli.ts's coverage-ignore rationale — real entry-point semantics run the
-   compiled dist directly, on the operator's own cron/scheduler cadence (D1:
-   no queue/timer infrastructure in this repo — an external scheduler runs
-   this command on whatever cadence the deployment chooses). */
-/**
- * Abandon-email sweep CLI entry (#3962 D1).
- *
- * Dev: `pnpm --filter @working-theory/api abandon:sweep` (tsx, this file).
- * Production: `node dist/bin/abandon-sweep.js` (the compiled entry, run by
- * any external scheduler — Vercel Cron, GitHub Actions cron, plain crontab).
- * The sweep is stateless and idempotent (D5), so overlap or a missed tick
- * is harmless — the delay window is data, not a timer.
- */
-import { runAbandonEmailSweep } from "../services/abandon-email.js";
-
-async function main(): Promise<void> {
-  const result = await runAbandonEmailSweep();
-
-  if (!result.ok) {
-    console.error(
-      `[abandon-sweep] ${result.error.kind}: ${result.error.message}`,
-    );
-    process.exitCode = 1;
-    return;
-  }
-
-  console.log(`[abandon-sweep] ${JSON.stringify(result.summary)}`);
-}
-
-main().catch((err: unknown) => {
-  // Belt-and-suspenders (code-review finding on #3962's acceptance PR):
-  // runAbandonEmailSweep already catches internally and returns a
-  // structured `unexpected_error` result, so this path is unreachable in
-  // practice — it exists only to prevent a bare unhandled-rejection crash
-  // if `main` itself ever throws before/around that call.
-  const message = err instanceof Error ? err.message : "Unknown error";
-  console.error(`[abandon-sweep] unexpected_error: ${message}`);
-  process.exitCode = 1;
-});

package/templates/apps/api/src/bin/rate-limit-probe.ts

@@ -1,53 +0,0 @@
-#!/usr/bin/env node
-/* istanbul ignore file -- CLI bootstrap; the logic it wraps
-   (runRateLimitProbe) is unit-tested directly in __tests__/rate-limit-probe.test.ts
-   — the abandon-sweep.ts / lib/abandon-email.ts split. */
-/**
- * The live rate-limiter probe (#5040 D9, FR-7, AC-10).
- *
- * Dev:        `pnpm --filter @working-theory/api rate-limit:probe --origin <https origin>`
- * Production: `node dist/bin/rate-limit-probe.js --origin <https origin>`
- *
- * Answers the two platform facts #5040 and #5111 need a live deployment for:
- *
- *   1. Does a client-chosen `x-forwarded-for` survive to the serverless
- *      function, or does the edge overwrite it? (`xff: survives | overwritten`)
- *   2. Does a concurrent burst against ONE identity stay within the
- *      configured limit? (`burst: holds | exceeded | inconclusive`)
- *
- * It only ever calls `GET <origin>/v1/aeo/score/example` — a no-fetch,
- * no-write read already behind the aeo scope's strict limiter (#5111) — and
- * refuses an origin that is not `https:` or loopback `http:` before any
- * network call.
- */
-import { runRateLimitProbe } from "../lib/rate-limit-probe.js";
-
-function parseOrigin(argv: readonly string[]): string | undefined {
-  const index = argv.indexOf("--origin");
-  return index === -1 ? undefined : argv[index + 1];
-}
-
-async function main(): Promise<number> {
-  const origin = parseOrigin(process.argv.slice(2));
-  if (!origin) {
-    console.log("probe: error missing --origin");
-    return 2;
-  }
-  return runRateLimitProbe({
-    origin,
-    fetch: (url, init) => globalThis.fetch(url, init),
-  });
-}
-
-main()
-  .then((code) => {
-    process.exitCode = code;
-  })
-  .catch((err: unknown) => {
-    // Belt-and-braces, as abandon-sweep.ts: runRateLimitProbe catches its own
-    // network/status errors, so this only stops a bare unhandled rejection.
-    console.log(
-      `probe: error ${err instanceof Error ? err.message : String(err)}`,
-    );
-    process.exitCode = 2;
-  });