create-ailk 0.23.0 → 0.25.1

package/templates/apps/api/src/config/__tests__/modules.test.ts

@@ -1,76 +0,0 @@
-/**
- * `isModuleEnabled()` default-flip regression test (D-44, #5368).
- *
- * Proves the mechanical claim #5368 exists to make true: an UNSET
- * `AILK_ENABLED_MODULES` now gates every paid module OFF, the same as an
- * explicit empty string — only an explicit allowlist turns modules on, and
- * turns on exactly the modules it names.
- *
- * Reverting `enabledModules()`'s unset branch back to the `undefined`
- * sentinel (S1, #5088's original shape) makes the "unset" cases below fail
- * RED — see #5368 verification notes.
- */
-
-import { isModuleEnabled } from '../modules';
-
-const RECOGNIZED_MODULES = [
-  'docs',
-  'multi-tenant',
-  'scheduling',
-  'content-write',
-] as const;
-
-describe('isModuleEnabled', () => {
-  const originalEnv = process.env.AILK_ENABLED_MODULES;
-
-  afterEach(() => {
-    if (originalEnv === undefined) {
-      delete process.env.AILK_ENABLED_MODULES;
-    } else {
-      process.env.AILK_ENABLED_MODULES = originalEnv;
-    }
-  });
-
-  describe('AILK_ENABLED_MODULES unset', () => {
-    it.each(RECOGNIZED_MODULES)('returns false for %s', (moduleName) => {
-      delete process.env.AILK_ENABLED_MODULES;
-      expect(isModuleEnabled(moduleName)).toBe(false);
-    });
-  });
-
-  describe('AILK_ENABLED_MODULES=""', () => {
-    it.each(RECOGNIZED_MODULES)('returns false for %s', (moduleName) => {
-      process.env.AILK_ENABLED_MODULES = '';
-      expect(isModuleEnabled(moduleName)).toBe(false);
-    });
-  });
-
-  describe('AILK_ENABLED_MODULES as an explicit allowlist', () => {
-    it.each(RECOGNIZED_MODULES)(
-      'enables exactly the listed modules — %s on when named',
-      (moduleName) => {
-        process.env.AILK_ENABLED_MODULES = moduleName;
-        expect(isModuleEnabled(moduleName)).toBe(true);
-        for (const other of RECOGNIZED_MODULES) {
-          if (other === moduleName) continue;
-          expect(isModuleEnabled(other)).toBe(false);
-        }
-      },
-    );
-
-    it('enables every module named in a comma list, and no others', () => {
-      process.env.AILK_ENABLED_MODULES = 'multi-tenant,scheduling';
-      expect(isModuleEnabled('multi-tenant')).toBe(true);
-      expect(isModuleEnabled('scheduling')).toBe(true);
-      expect(isModuleEnabled('docs')).toBe(false);
-      expect(isModuleEnabled('content-write')).toBe(false);
-    });
-
-    it('trims whitespace and drops empty entries, same as before the flip', () => {
-      process.env.AILK_ENABLED_MODULES = ' multi-tenant , , scheduling ';
-      expect(isModuleEnabled('multi-tenant')).toBe(true);
-      expect(isModuleEnabled('scheduling')).toBe(true);
-      expect(isModuleEnabled('docs')).toBe(false);
-    });
-  });
-});

package/templates/apps/api/src/config/__tests__/stripe-connection-key.test.ts

@@ -1,185 +0,0 @@
-/**
- * @file stripe-connection-key.test.ts
- * @description STRIPE_CONNECTION_KEY and STRIPE_CONNECTION_KEY_PREVIOUS — the
- * keys an Organization's Stripe connection is encrypted under (#8907 D3,
- * AC-9; contract C3, C10).
- *
- * `resolveStripeConnectionKeys` reads both with the scheduling key's shape
- * rule (canonical standard base64 of exactly 32 bytes), refuses a previous
- * key with no current one or equal to it, and refuses either when it is the
- * scheduling key — so one key never guards calendars and money. A refused
- * key stops the API at startup; a refusal names the variable and the reason
- * kind, never any part of the value. Unset is a supported state.
- */
-
-// Mock dotenv so a developer's local .env never leaks into the config module.
-jest.mock("dotenv", () => ({
-  config: jest.fn(),
-}));
-
-const mockLoggerError = jest.fn();
-jest.mock("@working-theory/observability", () => ({
-  logger: {
-    error: (...args: unknown[]) => mockLoggerError(...args),
-    warn: jest.fn(),
-    info: jest.fn(),
-    debug: jest.fn(),
-  },
-}));
-
-import { randomBytes } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-
-import { resolveStripeConnectionKeys } from "../index";
-
-const A = randomBytes(32);
-const B = randomBytes(32);
-const S = randomBytes(32);
-const b64 = (bytes: Buffer) => bytes.toString("base64");
-
-/** 32 bytes whose base64 differs from its base64url, so the url form is refused. */
-function urlOnlyKey(): string {
-  let bytes = randomBytes(32);
-  while (!/[+/]/.test(bytes.toString("base64"))) bytes = randomBytes(32);
-  return bytes.toString("base64url");
-}
-
-describe("resolveStripeConnectionKeys (#8907 D3)", () => {
-  it("answers both buffers for two distinct canonical 32-byte keys", () => {
-    const result = resolveStripeConnectionKeys({ current: b64(A), previous: b64(B), scheduling: S });
-    expect(result.kind).toBe("ok");
-    if (result.kind !== "ok") throw new Error("expected ok");
-    expect(result.current?.equals(A)).toBe(true);
-    expect(result.previous?.equals(B)).toBe(true);
-  });
-
-  it("answers ok with nothing when both are unset or empty", () => {
-    expect(resolveStripeConnectionKeys({ current: undefined, previous: "", scheduling: S })).toEqual({
-      kind: "ok",
-    });
-  });
-
-  it("answers the current key alone with no previous", () => {
-    const result = resolveStripeConnectionKeys({ current: b64(A), previous: undefined, scheduling: undefined });
-    expect(result).toEqual({ kind: "ok", current: A });
-  });
-
-  const urlKey = urlOnlyKey();
-  const shortKey = b64(randomBytes(16));
-  it.each([
-    ["a base64url current key", { current: urlKey }, "STRIPE_CONNECTION_KEY", "not-canonical-base64", urlKey],
-    ["a 16-byte current key", { current: shortKey }, "STRIPE_CONNECTION_KEY", "length", shortKey],
-    [
-      "a 16-byte previous key",
-      { current: b64(A), previous: shortKey },
-      "STRIPE_CONNECTION_KEY_PREVIOUS",
-      "length",
-      shortKey,
-    ],
-    [
-      "a previous key with no current",
-      { previous: b64(B) },
-      "STRIPE_CONNECTION_KEY_PREVIOUS",
-      "previous_without_current",
-      b64(B),
-    ],
-    [
-      "equal current and previous",
-      { current: b64(A), previous: b64(A) },
-      "STRIPE_CONNECTION_KEY_PREVIOUS",
-      "previous_equals_current",
-      b64(A),
-    ],
-    [
-      "a current key equal to the scheduling key",
-      { current: b64(S) },
-      "STRIPE_CONNECTION_KEY",
-      "shared_with_scheduling",
-      b64(S),
-    ],
-    [
-      "a previous key equal to the scheduling key",
-      { current: b64(A), previous: b64(S) },
-      "STRIPE_CONNECTION_KEY_PREVIOUS",
-      "shared_with_scheduling",
-      b64(S),
-    ],
-  ])("refuses %s, naming the variable and the reason only", (_label, raw, variable, reason, value) => {
-    const result = resolveStripeConnectionKeys({
-      current: (raw as { current?: string }).current,
-      previous: (raw as { previous?: string }).previous,
-      scheduling: S,
-    });
-    expect(result).toEqual({ kind: "refused", variable, reason });
-    expect(JSON.stringify(result)).not.toContain(value.slice(0, 8));
-  });
-});
-
-describe("config.STRIPE_CONNECTION_KEY at startup (#8907 D3)", () => {
-  const originalEnv = process.env;
-
-  beforeEach(() => {
-    jest.resetModules();
-    process.env = { ...originalEnv };
-    delete process.env.AILK_ENABLED_MODULES;
-    delete process.env.AILK_TRUSTED_ORIGINS;
-    delete process.env.SCHEDULING_CREDENTIAL_KEY;
-    delete process.env.STRIPE_CONNECTION_KEY;
-    delete process.env.STRIPE_CONNECTION_KEY_PREVIOUS;
-    jest.clearAllMocks();
-  });
-
-  afterEach(() => {
-    process.env = originalEnv;
-    jest.restoreAllMocks();
-  });
-
-  it("exposes the decoded keys when they are valid, and nothing when unset", () => {
-    process.env.STRIPE_CONNECTION_KEY = b64(A);
-    process.env.STRIPE_CONNECTION_KEY_PREVIOUS = b64(B);
-    const { config } = require("../index");
-    expect(config.STRIPE_CONNECTION_KEY.equals(A)).toBe(true);
-    expect(config.STRIPE_CONNECTION_KEY_PREVIOUS.equals(B)).toBe(true);
-
-    jest.resetModules();
-    delete process.env.STRIPE_CONNECTION_KEY;
-    delete process.env.STRIPE_CONNECTION_KEY_PREVIOUS;
-    const { config: unset } = require("../index");
-    expect(unset.STRIPE_CONNECTION_KEY).toBeUndefined();
-    expect(unset.STRIPE_CONNECTION_KEY_PREVIOUS).toBeUndefined();
-  });
-
-  it.each([
-    ["a 31-byte key", { STRIPE_CONNECTION_KEY: b64(randomBytes(31)) }],
-    ["the scheduling key", { STRIPE_CONNECTION_KEY: b64(S), SCHEDULING_CREDENTIAL_KEY: b64(S) }],
-    ["a previous key alone", { STRIPE_CONNECTION_KEY_PREVIOUS: b64(B) }],
-  ])("exits on a refused value (%s), logging the variable but never the value", (_label, env) => {
-    Object.assign(process.env, env);
-    const exitSpy = jest.spyOn(process, "exit").mockImplementation(() => {
-      throw new Error("Process exit called");
-    });
-    const consoleError = jest.spyOn(console, "error").mockImplementation(() => undefined);
-
-    expect(() => require("../index")).toThrow("Process exit called");
-    expect(exitSpy).toHaveBeenCalledWith(1);
-    expect(mockLoggerError).toHaveBeenCalledTimes(1);
-
-    const logged = JSON.stringify([mockLoggerError.mock.calls, consoleError.mock.calls]);
-    expect(logged).toContain("STRIPE_CONNECTION_KEY");
-    for (const value of Object.values(env)) {
-      expect(logged).not.toContain(value);
-      expect(logged).not.toContain(value.slice(0, 12));
-    }
-  });
-});
-
-describe("the .env.example files (#8907 D3)", () => {
-  const REPO_ROOT = join(__dirname, "..", "..", "..", "..", "..");
-
-  it.each([".env.example", "apps/api/.env.example"])("%s documents both variables, commented out", (file) => {
-    const text = readFileSync(join(REPO_ROOT, file), "utf8");
-    expect(text).toMatch(/^# STRIPE_CONNECTION_KEY=$/m);
-    expect(text).toMatch(/^# STRIPE_CONNECTION_KEY_PREVIOUS=$/m);
-  });
-});

package/templates/apps/api/src/config/__tests__/trusted-origins.test.ts

@@ -1,238 +0,0 @@
-/**
- * @file trusted-origins.test.ts
- * @description The trusted browser-origin allowlist (#7395 AC-2).
- *
- * `resolveTrustedOrigins` is the one derivation CORS, the cookie-forwarded
- * write check and the checkout redirect lock all read (spec D2/D4). It takes
- * `FRONTEND_URL` (lenient, as today) plus the opt-in `AILK_TRUSTED_ORIGINS`
- * (strict: an entry must already be written exactly as a browser serialises
- * an `Origin` header). A refused entry stops the process at startup (D3), and
- * the refusal log names the entry's position and reason, never its text.
- */
-
-// Mock dotenv so a developer's local .env never leaks into the config module.
-jest.mock('dotenv', () => ({
-  config: jest.fn(),
-}));
-
-const mockLoggerError = jest.fn();
-const mockLoggerWarn = jest.fn();
-jest.mock('@working-theory/observability', () => ({
-  logger: {
-    error: (...args: unknown[]) => mockLoggerError(...args),
-    warn: (...args: unknown[]) => mockLoggerWarn(...args),
-    info: jest.fn(),
-    debug: jest.fn(),
-  },
-}));
-
-import { resolveTrustedOrigins } from '../index';
-
-describe('resolveTrustedOrigins (#7395 D2)', () => {
-  it('normalises the primary, trims and de-duplicates the extras, and keeps first-seen order', () => {
-    const result = resolveTrustedOrigins({
-      FRONTEND_URL: 'https://hub.example/',
-      AILK_TRUSTED_ORIGINS:
-        ' https://admin.hub.example,https://spoke-a.example,,https://hub.example',
-      NODE_ENV: 'production',
-    });
-
-    expect(result.origins).toEqual([
-      'https://hub.example',
-      'https://admin.hub.example',
-      'https://spoke-a.example',
-    ]);
-    expect(result.refused).toEqual([]);
-    expect(result.primaryUnusable).toBe(false);
-    expect(Object.isFrozen(result.origins)).toBe(true);
-  });
-
-  it.each([
-    ['*', 'wildcard'],
-    ['https://*.example.com', 'wildcard'],
-    ['null', 'unparseable'],
-    ['https://a.example/', 'not-canonical'],
-    ['https://a.example/app', 'not-canonical'],
-    ['HTTPS://A.EXAMPLE', 'not-canonical'],
-    ['https://a.example:443', 'not-canonical'],
-    ['ftp://a.example', 'scheme'],
-    ['not a url', 'unparseable'],
-    ['https://user:pw@a.example', 'not-canonical'],
-    ['https://bücher.example', 'not-canonical'],
-    ['https://a.example.', 'trailing-dot'],
-    ['http://a.example', 'scheme'],
-  ])('refuses the extra %j in production (%s)', (entry, reason) => {
-    const result = resolveTrustedOrigins({
-      FRONTEND_URL: 'https://hub.example',
-      AILK_TRUSTED_ORIGINS: `https://ok.example,${entry}`,
-      NODE_ENV: 'production',
-    });
-
-    expect(result.refused).toEqual([{ position: 2, reason }]);
-    expect(result.origins).toEqual(['https://hub.example', 'https://ok.example']);
-  });
-
-  it('accepts a plain-http extra outside production', () => {
-    const result = resolveTrustedOrigins({
-      FRONTEND_URL: 'http://localhost:3000',
-      AILK_TRUSTED_ORIGINS: 'http://a.example',
-      NODE_ENV: 'development',
-    });
-
-    expect(result.refused).toEqual([]);
-    expect(result.origins).toEqual(['http://localhost:3000', 'http://a.example']);
-  });
-
-  it('carries no raw entry text in its result', () => {
-    const result = resolveTrustedOrigins({
-      FRONTEND_URL: 'https://hub.example',
-      AILK_TRUSTED_ORIGINS: 'https://user:pw@a.example',
-      NODE_ENV: 'production',
-    });
-
-    expect(JSON.stringify(result)).not.toContain('pw');
-  });
-
-  it.each([
-    'https://*',
-    // WHATWG decodes `%2A` in a host, so this parses to origin https://*.example.com.
-    'https://%2A.example.com',
-    'https://a.example,https://b.example',
-    'not a url',
-    'mailto:ops@example.com',
-  ])(
-    'a FRONTEND_URL of %j contributes no origin and is reported unusable',
-    (frontendUrl) => {
-      const result = resolveTrustedOrigins({
-        FRONTEND_URL: frontendUrl,
-        AILK_TRUSTED_ORIGINS: 'https://spoke-a.example',
-        NODE_ENV: 'production',
-      });
-
-      expect(result.origins).toEqual(['https://spoke-a.example']);
-      expect(result.primaryUnusable).toBe(true);
-      expect(result.refused).toEqual([]);
-    },
-  );
-
-  it('keeps a plain-http primary in production, as today', () => {
-    const result = resolveTrustedOrigins({
-      FRONTEND_URL: 'http://site.example',
-      NODE_ENV: 'production',
-    });
-
-    expect(result.origins).toEqual(['http://site.example']);
-    expect(result.primaryUnusable).toBe(false);
-  });
-
-  it('defaults an unset primary to http://localhost:3000 outside production', () => {
-    const result = resolveTrustedOrigins({ NODE_ENV: 'development' });
-
-    expect(result.origins).toEqual(['http://localhost:3000']);
-    expect(result.primaryUnusable).toBe(false);
-  });
-
-  it('trusts nothing for an unset primary in production, without reporting it unusable', () => {
-    const result = resolveTrustedOrigins({ NODE_ENV: 'production' });
-
-    expect(result.origins).toEqual([]);
-    expect(result.primaryUnusable).toBe(false);
-  });
-
-  it('trusts only the extras for an unset primary in production', () => {
-    const result = resolveTrustedOrigins({
-      AILK_TRUSTED_ORIGINS: 'https://hub.example',
-      NODE_ENV: 'production',
-    });
-
-    expect(result.origins).toEqual(['https://hub.example']);
-  });
-});
-
-describe('config.TRUSTED_ORIGINS at startup (#7395 D3/D5)', () => {
-  const originalEnv = process.env;
-
-  beforeEach(() => {
-    jest.resetModules();
-    process.env = { ...originalEnv };
-    // Cleared so a production boot never trips config's database-module exit.
-    delete process.env.AILK_ENABLED_MODULES;
-    jest.clearAllMocks();
-  });
-
-  afterEach(() => {
-    process.env = originalEnv;
-    jest.restoreAllMocks();
-  });
-
-  it('exposes the resolved, frozen list on config', () => {
-    process.env.FRONTEND_URL = 'https://hub.example/';
-    process.env.AILK_TRUSTED_ORIGINS = 'https://spoke-a.example';
-
-    const { config } = require('../index');
-
-    expect(config.TRUSTED_ORIGINS).toEqual(['https://hub.example', 'https://spoke-a.example']);
-    expect(Object.isFrozen(config.TRUSTED_ORIGINS)).toBe(true);
-    expect(config.AILK_TRUSTED_ORIGINS).toBe('https://spoke-a.example');
-    // FRONTEND_URL keeps its job as the primary site's address (D7).
-    expect(config.FRONTEND_URL).toBe('https://hub.example/');
-  });
-
-  it.each(['production', 'development'])(
-    'exits with a refused entry in %s, logging its position and reason but never its text',
-    (nodeEnv) => {
-      process.env.NODE_ENV = nodeEnv;
-      process.env.FRONTEND_URL = 'https://hub.example';
-      process.env.AILK_TRUSTED_ORIGINS = 'https://spoke-a.example,https://user:pw@a.example';
-      const exitSpy = jest.spyOn(process, 'exit').mockImplementation(() => {
-        throw new Error('Process exit called');
-      });
-      const consoleError = jest.spyOn(console, 'error').mockImplementation(() => undefined);
-
-      expect(() => require('../index')).toThrow('Process exit called');
-      expect(exitSpy).toHaveBeenCalledWith(1);
-      expect(mockLoggerError).toHaveBeenCalledTimes(1);
-
-      const logged = JSON.stringify([mockLoggerError.mock.calls, consoleError.mock.calls]);
-      expect(logged).toContain('AILK_TRUSTED_ORIGINS');
-      expect(logged).toContain('"position":2');
-      expect(logged).toContain('"reason":"not-canonical"');
-      expect(logged).not.toContain('pw');
-      expect(logged).not.toContain('a.example');
-      // The same line also reaches console.error, which survives a worker
-      // transport dropping the last line before exit (spec § 9 SA-08).
-      expect(consoleError).toHaveBeenCalledTimes(1);
-    },
-  );
-
-  it.each(['production', 'development'])(
-    'logs, without exiting or echoing it, a FRONTEND_URL that is set but unusable (%s)',
-    (nodeEnv) => {
-      process.env.NODE_ENV = nodeEnv;
-      process.env.FRONTEND_URL = 'https://secret-token*@hub.example';
-      delete process.env.AILK_TRUSTED_ORIGINS;
-      const exitSpy = jest.spyOn(process, 'exit').mockImplementation(() => {
-        throw new Error('Process exit called');
-      });
-
-      const { config } = require('../index');
-
-      expect(exitSpy).not.toHaveBeenCalled();
-      expect(config.TRUSTED_ORIGINS).toEqual([]);
-      expect(mockLoggerError).toHaveBeenCalledTimes(1);
-      const logged = JSON.stringify(mockLoggerError.mock.calls);
-      expect(logged).toContain('FRONTEND_URL is set but');
-      expect(logged).not.toContain('secret-token');
-    },
-  );
-
-  it('logs no error for a usable FRONTEND_URL and no extras', () => {
-    process.env.FRONTEND_URL = 'https://hub.example';
-    delete process.env.AILK_TRUSTED_ORIGINS;
-
-    const { config } = require('../index');
-
-    expect(config.TRUSTED_ORIGINS).toEqual(['https://hub.example']);
-    expect(mockLoggerError).not.toHaveBeenCalled();
-  });
-});