create-ailk 0.23.0 → 0.25.1

package/templates/apps/api/src/routes/content/__tests__/rate-limit.test.ts

@@ -1,51 +0,0 @@
-/**
- * @file rate-limit.test.ts
- * Verifies the content API enforces a 60 req/min/IP unauth rate limit.
- *
- * Uses the real content adapter backed by a per-test temp dir (Issue #507).
- * No internal module mocks.
- */
-
-import type { FastifyInstance } from "fastify";
-
-import { setupContentFixture } from "../../../__tests__/factories/content-fixture";
-import { contentRoutes } from "../index";
-import { CONTENT_RATE_LIMIT_UNAUTH } from "../rate-limit";
-
-setupContentFixture();
-
-describe("Content API rate limiting", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    app = require("fastify")();
-    const rateLimit = require("@fastify/rate-limit");
-    await app.register(rateLimit, {
-      max: CONTENT_RATE_LIMIT_UNAUTH,
-      timeWindow: "1 minute",
-      keyGenerator: () => "shared-test-ip",
-    });
-    await app.register(contentRoutes);
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("returns 429 once unauth requests exceed the per-minute limit", async () => {
-    expect(CONTENT_RATE_LIMIT_UNAUTH).toBe(60);
-
-    // Burn through the allowance.
-    for (let i = 0; i < CONTENT_RATE_LIMIT_UNAUTH; i++) {
-      const ok = await app.inject({ method: "GET", url: "/v1/content/types" });
-      expect(ok.statusCode).toBe(200);
-    }
-
-    // The next request crosses the threshold.
-    const overLimit = await app.inject({
-      method: "GET",
-      url: "/v1/content/types",
-    });
-    expect(overLimit.statusCode).toBe(429);
-  });
-});

package/templates/apps/api/src/routes/content/__tests__/search.test.ts

@@ -1,450 +0,0 @@
-/**
- * @file search.test.ts
- * GET /v1/content/search — keyword search across published pages (#5831).
- *
- * Uses the real content adapter backed by a per-test temp dir (Issue #507).
- * No internal module mocks — the route exercises the real adapter stack.
- *
- * The `category`-tagged fixtures are written here rather than through
- * `writeFixturePage`, whose frontmatter parameter is `Record<string, string>`
- * and so cannot express a YAML sequence.
- */
-
-import * as fs from "fs/promises";
-import * as path from "path";
-
-import type { FastifyInstance } from "fastify";
-
-import { setupContentFixture } from "../../../__tests__/factories/content-fixture";
-import { getContentAdapter } from "../../../lib/content-adapter";
-import { contentRoutes } from "../index";
-import { CONTENT_RATE_LIMIT_UNAUTH, CONTENT_RATE_LIMIT_WINDOW } from "../rate-limit";
-
-const fixture = setupContentFixture();
-
-/** Writes an MDX page with a `categories:` sequence into the locale path. */
-async function writeCategorisedPage(
-  slug: string,
-  title: string,
-  description: string,
-  categories: readonly string[],
-  body: string,
-): Promise<void> {
-  const dir = path.join(fixture.getContentRoot(), "en", "Product");
-  await fs.mkdir(dir, { recursive: true });
-  const frontmatter = [
-    `type: "Product"`,
-    `slug: "${slug}"`,
-    `title: "${title}"`,
-    `description: "${description}"`,
-    ...(categories.length > 0
-      ? ["categories:", ...categories.map((c) => `  - ${c}`)]
-      : []),
-  ].join("\n");
-  await fs.writeFile(
-    path.join(dir, `${slug}.mdx`),
-    `---\n${frontmatter}\n---\n\n${body}\n`,
-    "utf8",
-  );
-}
-
-async function seedRoofPages(): Promise<void> {
-  await writeCategorisedPage(
-    "roof-replacement",
-    "Roof Replacement",
-    "A full roof replacement service.",
-    ["roofing"],
-    "We replace a roof in a day.",
-  );
-  await writeCategorisedPage(
-    "attic-ventilation",
-    "Attic Ventilation",
-    "Ventilation that protects the roof deck.",
-    ["hvac"],
-    "Attic airflow keeps a roof healthy.",
-  );
-  await writeCategorisedPage(
-    "untagged-roof-guide",
-    "Roof Care Guide",
-    "How to look after a roof.",
-    [],
-    "A roof lasts longer when it is inspected.",
-  );
-}
-
-describe("GET /v1/content/search", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    app = require("fastify")();
-    await app.register(contentRoutes);
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("returns 200 with a JSON-LD ItemList envelope", async () => {
-    await seedRoofPages();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/content/search?q=roof",
-    });
-
-    expect(res.statusCode).toBe(200);
-    const body = JSON.parse(res.body);
-    expect(body["@context"]).toBe("https://schema.org");
-    expect(body["@type"]).toBe("ItemList");
-    expect(body.query).toBe("roof");
-    expect(Array.isArray(body.items)).toBe(true);
-    expect(body.totalItems).toBe(body.items.length);
-    expect(body.items.map((i: { slug: string }) => i.slug).sort()).toEqual([
-      "attic-ventilation",
-      "roof-replacement",
-      "untagged-roof-guide",
-    ]);
-  });
-
-  it("filters on category — only the tagged page comes back", async () => {
-    await seedRoofPages();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/content/search?q=roof&category=roofing",
-    });
-
-    expect(res.statusCode).toBe(200);
-    const body = JSON.parse(res.body);
-    expect(body.items.map((i: { slug: string }) => i.slug)).toEqual([
-      "roof-replacement",
-    ]);
-    expect(body.totalItems).toBe(1);
-  });
-
-  it("returns an empty ItemList for a registry slug nothing is tagged with", async () => {
-    await seedRoofPages();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/content/search?q=roof&category=legal",
-    });
-
-    expect(res.statusCode).toBe(200);
-    const body = JSON.parse(res.body);
-    expect(body.items).toEqual([]);
-    expect(body.totalItems).toBe(0);
-  });
-
-  it("composes the type and category filters", async () => {
-    await seedRoofPages();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/content/search?q=roof&type=HomePage&category=roofing",
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(JSON.parse(res.body).items).toEqual([]);
-  });
-
-  it("honours limit", async () => {
-    await seedRoofPages();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/content/search?q=roof&limit=1",
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(JSON.parse(res.body).items).toHaveLength(1);
-  });
-
-  it("is not shadowed by the /v1/content/:type route", async () => {
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/content/search?q=roof",
-    });
-    // A `:type` match would 400 on the type enum; a search match 200s.
-    expect(res.statusCode).toBe(200);
-    expect(JSON.parse(res.body).query).toBe("roof");
-  });
-
-  describe("400s on an invalid query", () => {
-    it("rejects a missing q", async () => {
-      const res = await app.inject({
-        method: "GET",
-        url: "/v1/content/search",
-      });
-      expect(res.statusCode).toBe(400);
-      const body = JSON.parse(res.body);
-      expect(body.error).toBe("Invalid query parameters");
-      expect(Array.isArray(body.details)).toBe(true);
-    });
-
-    it("rejects an empty q", async () => {
-      const res = await app.inject({
-        method: "GET",
-        url: "/v1/content/search?q=",
-      });
-      expect(res.statusCode).toBe(400);
-    });
-
-    it("rejects a category outside the registry", async () => {
-      const res = await app.inject({
-        method: "GET",
-        url: "/v1/content/search?q=roof&category=not-a-real-category",
-      });
-      expect(res.statusCode).toBe(400);
-      const body = JSON.parse(res.body);
-      expect(body.details.some((d: { path: string[] }) => d.path.includes("category"))).toBe(true);
-    });
-
-    it("rejects a type outside the schema.org enum", async () => {
-      const res = await app.inject({
-        method: "GET",
-        url: "/v1/content/search?q=roof&type=NotAType",
-      });
-      expect(res.statusCode).toBe(400);
-    });
-
-    it("rejects a q longer than the 200-char ceiling", async () => {
-      const res = await app.inject({
-        method: "GET",
-        url: `/v1/content/search?q=${"a".repeat(201)}`,
-      });
-      expect(res.statusCode).toBe(400);
-      const body = JSON.parse(res.body);
-      expect(
-        body.details.some((d: { path: string[] }) => d.path.includes("q")),
-      ).toBe(true);
-    });
-
-    it("accepts a q of exactly 200 chars — the same ceiling the MCP tool enforces", async () => {
-      const res = await app.inject({
-        method: "GET",
-        url: `/v1/content/search?q=${"a".repeat(200)}`,
-      });
-      expect(res.statusCode).toBe(200);
-    });
-
-    it("rejects a limit above the 50 ceiling", async () => {
-      const res = await app.inject({
-        method: "GET",
-        url: "/v1/content/search?q=roof&limit=51",
-      });
-      expect(res.statusCode).toBe(400);
-    });
-  });
-
-  /**
-   * D6 — API ↔ MCP parity evidence for #5831.
-   *
-   * The tool and the route must return the same result set for the same
-   * arguments. `apps/api` cannot import `apps/mcp` (the hard import boundary
-   * in the root CLAUDE.md), so the shared seam is asserted instead: the route
-   * must return EXACTLY what `adapter.searchPages` returns for the options the
-   * MCP handler builds from the same arguments. `ailkSearchContent`'s own
-   * suite (`apps/mcp/__tests__/search_content.test.ts`) pins the other half —
-   * tool results ≡ `adapter.searchPages` for the same arguments — so the two
-   * halves compose into the 1:1 claim without either app importing the other.
-   */
-  describe("parity with the adapter the MCP tool calls (D6)", () => {
-    it("deep-equals adapter.searchPages items for the same arguments", async () => {
-      await seedRoofPages();
-
-      const res = await app.inject({
-        method: "GET",
-        url: "/v1/content/search?q=roof&category=roofing&limit=10&locale=en",
-      });
-      expect(res.statusCode).toBe(200);
-
-      // The exact option object `ailkSearchContent` builds for these arguments.
-      const expected = await getContentAdapter().searchPages("roof", {
-        limit: 10,
-        category: "roofing",
-        locale: "en",
-      });
-
-      expect(JSON.parse(res.body).items).toEqual(
-        JSON.parse(JSON.stringify(expected)),
-      );
-    });
-
-    it("deep-equals with no filters at all", async () => {
-      await seedRoofPages();
-
-      const res = await app.inject({
-        method: "GET",
-        url: "/v1/content/search?q=roof",
-      });
-
-      const expected = await getContentAdapter().searchPages("roof", {
-        limit: 10,
-        locale: "en",
-      });
-
-      expect(JSON.parse(res.body).items).toEqual(
-        JSON.parse(JSON.stringify(expected)),
-      );
-    });
-  });
-
-  /**
-   * `server.ts` registers the limiter GLOBALLY with the content ceiling, so
-   * this route is covered without registering one of its own. Asserting the
-   * shared constants is the honest check: a route test that registered its own
-   * limiter would prove nothing about the server.
-   */
-  describe("content rate limit", () => {
-    it("is governed by the same constants as the other content reads", async () => {
-      expect(CONTENT_RATE_LIMIT_UNAUTH).toBe(60);
-      expect(CONTENT_RATE_LIMIT_WINDOW).toBe("1 minute");
-    });
-
-    it("429s past the allowance under a limiter built from those constants", async () => {
-      const limited: FastifyInstance = require("fastify")();
-      const rateLimit = require("@fastify/rate-limit");
-      await limited.register(rateLimit, {
-        max: CONTENT_RATE_LIMIT_UNAUTH,
-        timeWindow: CONTENT_RATE_LIMIT_WINDOW,
-        keyGenerator: () => "shared-test-ip",
-      });
-      await limited.register(contentRoutes);
-
-      for (let i = 0; i < CONTENT_RATE_LIMIT_UNAUTH; i++) {
-        const ok = await limited.inject({
-          method: "GET",
-          url: "/v1/content/search?q=roof",
-        });
-        expect(ok.statusCode).toBe(200);
-      }
-
-      const overLimit = await limited.inject({
-        method: "GET",
-        url: "/v1/content/search?q=roof",
-      });
-      expect(overLimit.statusCode).toBe(429);
-
-      await limited.close();
-    });
-  });
-});
-
-// ─── #5852 / #5910 — the database path: which workspace a search read serves ─
-//
-// Appended, so every MDX case above is untouched. Database-free: the
-// module-level Prisma singleton is faked via the repo's manual-mock
-// convention (see get-page.test.ts's identical block — #5852), and
-// `jest.mock` is hoisted above the imports by ts-jest regardless of where it
-// is written. The MDX cases above never load `lib/prisma.js` — the
-// resolver's import is deferred behind the `CONTENT_ADAPTER=database`
-// branch — so the mock is inert for them.
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../../../lib/prisma.js");
-
-import {
-  DEFAULT_ORG_ID,
-  DEFAULT_WORKSPACE_ID,
-} from "@working-theory/database/tenancy";
-
-import { prisma } from "../../../lib/prisma.js";
-
-/** A one-workspace deployment seeded with the well-known default (mirrors get-page.test.ts). */
-function seedOneWorkspaceDeployment(): void {
-  (prisma.workspace.count as jest.Mock).mockResolvedValue(1);
-  (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
-    id: DEFAULT_WORKSPACE_ID,
-    organizationId: DEFAULT_ORG_ID,
-  });
-}
-
-describe("GET /v1/content/search under CONTENT_ADAPTER=database (#5852 / #5910)", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    process.env.CONTENT_ADAPTER = "database";
-    app = require("fastify")();
-    await app.register(contentRoutes);
-  });
-
-  afterEach(async () => {
-    delete process.env.CONTENT_ADAPTER;
-    await app.close();
-  });
-
-  // AC-1 — a resolvable single-workspace deployment returns the search
-  // ItemList, with no workspace id anywhere in the URL, and the underlying
-  // artifact read is bound to the resolved workspace.
-  it("returns the search ItemList for the seeded default workspace, with no workspace id in the URL", async () => {
-    seedOneWorkspaceDeployment();
-    (prisma.artifact.findMany as jest.Mock).mockResolvedValue([]);
-    (prisma.artifactVersion.findMany as jest.Mock).mockResolvedValue([]);
-
-    const url = "/v1/content/search?q=roof";
-    const res = await app.inject({ method: "GET", url });
-
-    expect(res.statusCode).toBe(200);
-    const body = JSON.parse(res.body);
-    expect(body["@type"]).toBe("ItemList");
-    expect(body.items).toEqual([]);
-    // The tenant is resolved server-side; it is never addressable from the wire.
-    expect(url).not.toMatch(/wksp_/);
-    expect(prisma.artifact.findMany).toHaveBeenCalledWith(
-      expect.objectContaining({
-        where: expect.objectContaining({ workspaceId: DEFAULT_WORKSPACE_ID }),
-      }),
-    );
-  });
-
-  // AC-1 — zero workspaces: 404 before any artifact query.
-  it("404s with zero workspaces, before any artifact query", async () => {
-    (prisma.workspace.count as jest.Mock).mockResolvedValue(0);
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/content/search?q=roof",
-    });
-
-    expect(res.statusCode).toBe(404);
-    expect(prisma.artifact.findMany).not.toHaveBeenCalled();
-  });
-
-  // AC-1 — two-or-more workspaces: ambiguous, so no site resolves; 404 before
-  // any artifact query.
-  it("404s with two-or-more workspaces, before any artifact query", async () => {
-    (prisma.workspace.count as jest.Mock).mockResolvedValue(2);
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/content/search?q=roof",
-    });
-
-    expect(res.statusCode).toBe(404);
-    expect(prisma.artifact.findMany).not.toHaveBeenCalled();
-  });
-
-  // The two unresolved arms answer with the SAME 404 body (AC-WCE-05 parity
-  // with get-page/list-pages) — a resolution failure carries no detail an
-  // unauthenticated caller could use to distinguish it from another cause.
-  it("answers both ambiguity arms with identical 404 bodies", async () => {
-    (prisma.workspace.count as jest.Mock).mockResolvedValue(0);
-    const empty = await app.inject({
-      method: "GET",
-      url: "/v1/content/search?q=roof",
-    });
-
-    jest.clearAllMocks();
-    (prisma.workspace.count as jest.Mock).mockResolvedValue(2);
-    const ambiguous = await app.inject({
-      method: "GET",
-      url: "/v1/content/search?q=roof",
-    });
-
-    expect(empty.statusCode).toBe(404);
-    expect(ambiguous.statusCode).toBe(404);
-    expect(ambiguous.body).toBe(empty.body);
-  });
-});