create-ailk 0.23.0 → 0.25.1

package/templates/apps/api/src/routes/leads/__tests__/spoke.test.ts

@@ -1,392 +0,0 @@
-/**
- * @file spoke.test.ts
- *
- * `POST /v1/leads/{submit,subscribe,callback}` called by a registered spoke of
- * a multi-workspace hub (#7532, spec
- * docs/specs/7532-a-spoke-s-public-reads-spec.md D3, D4; AC-2, AC-3, AC-5),
- * and a keyless caller of the same hub, refused with no switch set since #7633
- * (spec docs/specs/7633-expected-a-keyless-public-read-spec.md D3, D8; AC-1,
- * AC-5).
- * The three real lead routes run through the real resolver and the real
- * lead-routing service; only the database and the email provider are doubles.
- *
- * Fixture (spec § 5): three workspaces — the sentinel default `F` (the site
- * alias), `W1` and `W2`; spokes `S1` → `W1`, `S1b` → `W1`, `S2` → `W2`.
- * The registry is non-empty (`db.spoke.findFirst` answers a row), so this is
- * a hub in the #7633 sense.
- */
-import { createHash } from "node:crypto";
-import { Writable } from "node:stream";
-
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock (Jest requires explicit call for local files)
-jest.mock("../../../lib/prisma.js");
-
-jest.mock("@working-theory/email", () => ({
-  sendLeadNotification: jest.fn(),
-  sendRequestConfirmEmail: jest.fn(),
-  sendRequestPaidLinkEmail: jest.fn(),
-}));
-
-// @working-theory/license: consumed transitively by enrichment-shim; mocked to
-// avoid needing a license key in tests (the leads index suite's own reason).
-jest.mock("@working-theory/license", () => ({
-  checkLicense: jest.fn().mockResolvedValue({
-    tier: "free",
-    plan: null,
-    features: [],
-    expiresAt: null,
-    revoked: false,
-  }),
-}));
-
-// The real request-confirm service, with its link sender observable: a
-// spoke's callback must never reach it (spec D4, SEC-7532-2). The call itself
-// is what AC-2 asserts, so the double wraps the real function rather than
-// replacing it.
-// eslint-disable-next-line no-restricted-syntax -- AC-2 asserts this internal function is never called; requireActual keeps its behaviour
-jest.mock("../../../services/request-confirm.js", () => {
-  const actual = jest.requireActual("../../../services/request-confirm.js");
-  return {
-    ...actual,
-    sendRequestConfirmLink: jest.fn(actual.sendRequestConfirmLink),
-  };
-});
-
-import * as configModule from "../../../config/index.js";
-import type { HubSpokeKeyMode } from "../../../config/index.js";
-import {
-  SENTINEL_WORKSPACE_ID,
-  mockSentinelWorkspaceExists,
-} from "../../../lib/__mocks__/prisma.js";
-import { prisma } from "../../../lib/prisma.js";
-import { __resetSiteWorkspaceCacheForTests } from "../../../lib/site.js";
-import { __resetHubStatusForTests } from "../../../services/public-site-resolver.js";
-import { sendRequestConfirmLink } from "../../../services/request-confirm.js";
-import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
-import { leadCallbackRoute, leadSubmitRoute, leadSubscribeRoute } from "../index";
-
-const db = jest.mocked(prisma);
-const email = jest.requireMock("@working-theory/email") as {
-  sendLeadNotification: jest.Mock;
-  sendRequestConfirmEmail: jest.Mock;
-};
-
-const F = SENTINEL_WORKSPACE_ID;
-const W1 = "wksp_01920000-0000-7000-8000-0000000000b1";
-const W2 = "wksp_01920000-0000-7000-8000-0000000000b2";
-const S1 = "spoke_01920000-0000-7000-8000-0000000000c1";
-const S1B = "spoke_01920000-0000-7000-8000-0000000000c2";
-const S2 = "spoke_01920000-0000-7000-8000-0000000000c3";
-
-function spokeKey(tag: string): string {
-  return `ailk_spk_${tag}${"x".repeat(43 - tag.length)}`;
-}
-const KEY_S1 = spokeKey("S1");
-const KEY_S1B = spokeKey("S1b");
-const KEY_S2 = spokeKey("S2");
-const KEY_UNKNOWN = spokeKey("nobody");
-const ALL_KEYS = [KEY_S1, KEY_S1B, KEY_S2, KEY_UNKNOWN];
-
-const digest = (key: string) => createHash("sha256").update(key).digest("hex");
-
-function seedRegistry(revoked: readonly string[] = []): void {
-  const rows = new Map([
-    [digest(KEY_S1), { id: S1, workspaceId: W1, revokedAt: null as Date | null }],
-    [digest(KEY_S1B), { id: S1B, workspaceId: W1, revokedAt: null as Date | null }],
-    [digest(KEY_S2), { id: S2, workspaceId: W2, revokedAt: null as Date | null }],
-  ]);
-  for (const row of rows.values()) {
-    if (revoked.includes(row.id)) row.revokedAt = new Date();
-  }
-  db.spoke.findUnique.mockImplementation((async ({
-    where,
-  }: {
-    where: { credentialHash: string };
-  }) => rows.get(where.credentialHash) ?? null) as never);
-  // A non-empty registry: this deployment is a hub (#7633 D1).
-  db.spoke.findFirst.mockResolvedValue({ id: S1 } as never);
-}
-
-function setMode(mode: HubSpokeKeyMode): void {
-  jest.replaceProperty(configModule, "config", {
-    ...configModule.config,
-    AILK_HUB_REQUIRE_SPOKE_KEY: mode,
-  });
-}
-
-type Kind = "submit" | "subscribe" | "callback";
-
-/** Each kind's body — every one names `siteId: W2`, which must be ignored. */
-const BODIES: Record<Kind, Record<string, unknown>> = {
-  submit: {
-    siteId: W2,
-    source: "contact",
-    email: "prospect@example.com",
-    payload: { message: "hello" },
-  },
-  subscribe: { siteId: W2, source: "footer", email: "reader@example.com" },
-  callback: { siteId: W2, name: "Ada Lovelace", phone: "+44 7700 900000", payload: {} },
-};
-
-/** The create delegate each kind writes through. */
-function createDelegate(kind: Kind) {
-  if (kind === "submit") return db.lead.create;
-  if (kind === "subscribe") return db.subscriber.create;
-  return db.callback.create;
-}
-
-function expectNoWrite(): void {
-  expect(db.lead.create).not.toHaveBeenCalled();
-  expect(db.subscriber.create).not.toHaveBeenCalled();
-  expect(db.callback.create).not.toHaveBeenCalled();
-}
-
-const REQUEST_CONFIRM_ENV = [
-  "AILK_REQUEST_CONFIRM_ENABLED",
-  "AILK_REQUEST_CONFIRM_TO",
-  "AILK_REQUEST_CONFIRM_FROM",
-  "AILK_PUBLIC_API_URL",
-] as const;
-
-describe("a spoke calling the lead routes on a multi-workspace hub", () => {
-  setupLeadFileEnv("spoke");
-
-  let app: FastifyInstance;
-  let logLines: string[];
-
-  beforeEach(async () => {
-    // clearAllMocks (not reset): the license double's resolved value must
-    // survive between cases, as in the leads index suite.
-    jest.clearAllMocks();
-    __resetSiteWorkspaceCacheForTests();
-    process.env.DATABASE_URL = "postgres://stub";
-    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
-    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
-    setMode("auto");
-    __resetHubStatusForTests();
-    seedRegistry();
-    mockSentinelWorkspaceExists(db, W1, W2);
-    db.workspace.count.mockResolvedValue(3);
-    db.lead.create.mockResolvedValue({ id: "lead_01920000-0000-7000-8000-0000000000d1" } as never);
-    db.subscriber.create.mockResolvedValue({ id: "subscr_01920000-0000-7000-8000-0000000000d2" } as never);
-    db.callback.create.mockResolvedValue({ id: "callbk_01920000-0000-7000-8000-0000000000d3" } as never);
-    db.callback.updateMany.mockResolvedValue({ count: 1 });
-    email.sendLeadNotification.mockResolvedValue({ ok: true, messageId: "msg-test" });
-    email.sendRequestConfirmEmail.mockResolvedValue({ ok: true, messageId: "msg-confirm" });
-
-    logLines = [];
-    const stream = new Writable({
-      write(chunk, _encoding, done) {
-        logLines.push(String(chunk));
-        done();
-      },
-    });
-    app = Fastify({ logger: { level: "info", stream } });
-    await app.register(leadSubmitRoute);
-    await app.register(leadSubscribeRoute);
-    await app.register(leadCallbackRoute);
-    await app.ready();
-  });
-
-  afterEach(async () => {
-    await app.close();
-    // No log line written by any case carries a key, its digest or its prefix (AC-3).
-    const written = logLines.join("\n");
-    for (const key of ALL_KEYS) {
-      expect(written).not.toContain(key);
-      expect(written).not.toContain(digest(key));
-      expect(written).not.toContain(key.slice(0, 17));
-    }
-    jest.restoreAllMocks();
-    delete process.env.DATABASE_URL;
-    delete process.env.AILK_LEAD_NOTIFICATION_TO;
-    delete process.env.AILK_LEAD_NOTIFICATION_FROM;
-    for (const key of REQUEST_CONFIRM_ENV) delete process.env[key];
-  });
-
-  function post(kind: Kind, headers: Record<string, string> = {}, body = BODIES[kind]) {
-    return app.inject({ method: "POST", url: `/v1/leads/${kind}`, headers, payload: body });
-  }
-
-  // ── AC-2 ────────────────────────────────────────────────────────────────
-
-  describe.each<Kind>(["submit", "subscribe", "callback"])("POST /v1/leads/%s (AC-2)", (kind) => {
-    it("a spoke's lead lands in its own workspace, whatever siteId the body names", async () => {
-      const res = await post(kind, { "x-ailk-spoke-key": KEY_S1 });
-
-      expect(res.statusCode).toBe(201);
-      expect(res.json().persisted).toBe("db");
-      const create = createDelegate(kind);
-      expect(create).toHaveBeenCalledTimes(1);
-      const { data } = create.mock.calls[0]![0] as {
-        data: { siteId: string; workspaceId: string };
-      };
-      expect(data.siteId).toBe(W1);
-      expect(data.workspaceId).toBe(W1);
-    });
-
-    it("another spoke's lead lands in its own workspace", async () => {
-      const res = await post(kind, { "x-ailk-spoke-key": KEY_S2 }, {
-        ...BODIES[kind],
-        siteId: W1,
-      });
-
-      expect(res.statusCode).toBe(201);
-      const { data } = createDelegate(kind).mock.calls[0]![0] as {
-        data: { siteId: string; workspaceId: string };
-      };
-      expect(data.siteId).toBe(W2);
-      expect(data.workspaceId).toBe(W2);
-    });
-  });
-
-  it("a spoke's callback never takes request-and-confirm: the generic notification goes, no link is minted (AC-2, SEC-7532-2)", async () => {
-    process.env.AILK_REQUEST_CONFIRM_ENABLED = "true";
-    process.env.AILK_REQUEST_CONFIRM_TO = "owner@example.com";
-    process.env.AILK_REQUEST_CONFIRM_FROM = "hello@example.com";
-    process.env.AILK_PUBLIC_API_URL = "https://api.example.com";
-
-    const res = await post("callback", { "x-ailk-spoke-key": KEY_S1 });
-    expect(res.statusCode).toBe(201);
-    await new Promise((resolve) => setImmediate(resolve));
-
-    expect(sendRequestConfirmLink).not.toHaveBeenCalled();
-    expect(email.sendRequestConfirmEmail).not.toHaveBeenCalled();
-    expect(email.sendLeadNotification).toHaveBeenCalledTimes(1);
-    expect(db.callback.updateMany).not.toHaveBeenCalled();
-  });
-
-  // ── #7633 AC-1 — a keyless call on a hub, with no switch set ────────────
-
-  it.each<Kind>(["submit", "subscribe", "callback"])(
-    "a keyless POST /v1/leads/%s naming siteId W1 answers 503 tenant_unresolved — the very body an unknown key gets — with no write (#7633 AC-1)",
-    async (kind) => {
-      const body = { ...BODIES[kind], siteId: W1 };
-      const keyless = await post(kind, {}, body);
-
-      expect(keyless.statusCode).toBe(503);
-      expect(keyless.json().error).toBe("tenant_unresolved");
-      expectNoWrite();
-
-      const unknown = await post(kind, { "x-ailk-spoke-key": KEY_UNKNOWN }, body);
-      expect(keyless.statusCode).toBe(unknown.statusCode);
-      expect(keyless.json()).toEqual(unknown.json());
-      expectNoWrite();
-    },
-  );
-
-  // ── #7633 conductor amendment — lead capture is never lost ──────────────
-
-  it("a cold start whose hub-status read fails still captures a keyless lead (it reaches routeLead), logged at error", async () => {
-    __resetHubStatusForTests();
-    db.spoke.findFirst.mockRejectedValue(new Error("connection reset"));
-
-    const res = await post("submit");
-    expect(res.statusCode).toBe(201);
-    expect(db.lead.create).toHaveBeenCalledTimes(1);
-    const { data } = db.lead.create.mock.calls[0]![0] as { data: { siteId: string } };
-    expect(data.siteId).toBe(F);
-    expect(logLines.join("\n")).toContain('"level":50');
-  });
-
-  it("a process that has seen a hub keeps refusing a keyless lead through the same outage", async () => {
-    expect((await post("submit")).statusCode).toBe(503);
-    db.spoke.findFirst.mockRejectedValue(new Error("connection reset"));
-    expect((await post("submit")).statusCode).toBe(503);
-    expectNoWrite();
-  });
-
-  // ── AC-3 ────────────────────────────────────────────────────────────────
-
-  describe.each<[string, Record<string, string>, HubSpokeKeyMode]>([
-    ["(i) an unregistered key", { "x-ailk-spoke-key": KEY_UNKNOWN }, "auto"],
-    ["(ii) a duplicated header", { "x-ailk-spoke-key": `${KEY_S1}, ${KEY_S2}` }, "auto"],
-    ["(iii) an empty key", { "x-ailk-spoke-key": "" }, "auto"],
-    [
-      "(v) mode \"on\", a header-less request naming W1 every other way",
-      {
-        host: "w1.example",
-        "x-forwarded-host": "w1.example",
-        origin: "https://w1.example",
-        "x-ailk-workspace-id": W1,
-      },
-      "on",
-    ],
-    [
-      "(v) no switch set, a header-less request naming W1 every other way (#7633)",
-      {
-        host: "w1.example",
-        "x-forwarded-host": "w1.example",
-        origin: "https://w1.example",
-        "x-ailk-workspace-id": W1,
-      },
-      "auto",
-    ],
-  ])("%s (AC-3)", (_label, headers, mode) => {
-    it.each<Kind>(["submit", "subscribe", "callback"])(
-      "POST /v1/leads/%s answers 503 tenant_unresolved before any write",
-      async (kind) => {
-        setMode(mode);
-        const res = await post(kind, headers, { ...BODIES[kind], siteId: W1 });
-
-        expect(res.statusCode).toBe(503);
-        expect(res.json().error).toBe("tenant_unresolved");
-        expectNoWrite();
-      },
-    );
-  });
-
-  it("(iv) a valid key with DATABASE_URL unset answers 503 — never the zero-config alias", async () => {
-    delete process.env.DATABASE_URL;
-    const res = await post("submit", { "x-ailk-spoke-key": KEY_S1 });
-
-    expect(res.statusCode).toBe(503);
-    expect(res.json().error).toBe("tenant_unresolved");
-    expectNoWrite();
-  });
-
-  // ── AC-5 ────────────────────────────────────────────────────────────────
-
-  describe("with S1 revoked (AC-5)", () => {
-    beforeEach(() => {
-      seedRegistry([S1]);
-    });
-
-    it("S1's key gets 503 with no write; S1b (also W1) and S2 keep their own workspaces", async () => {
-      const revoked = await post("submit", { "x-ailk-spoke-key": KEY_S1 });
-      expect(revoked.statusCode).toBe(503);
-      expectNoWrite();
-
-      const sibling = await post("submit", { "x-ailk-spoke-key": KEY_S1B });
-      expect(sibling.statusCode).toBe(201);
-      const siblingData = (db.lead.create.mock.calls[0]![0] as { data: { workspaceId: string } }).data;
-      expect(siblingData.workspaceId).toBe(W1);
-
-      const other = await post("submit", { "x-ailk-spoke-key": KEY_S2 });
-      expect(other.statusCode).toBe(201);
-      const otherData = (db.lead.create.mock.calls[1]![0] as { data: { workspaceId: string } }).data;
-      expect(otherData.workspaceId).toBe(W2);
-    });
-
-    it.each<HubSpokeKeyMode>(["on", "auto"])("in mode %j, S1's header-less retry is refused too", async (mode) => {
-      setMode(mode);
-      const res = await post("submit");
-      expect(res.statusCode).toBe(503);
-      expectNoWrite();
-    });
-
-    it("under the emergency opt-out (mode \"off\"), S1's header-less retry is anonymous and lands under the alias F, never W1 (SEC-7532-3)", async () => {
-      setMode("off");
-      const res = await post("submit");
-      expect(res.statusCode).toBe(201);
-      const { data } = db.lead.create.mock.calls[0]![0] as {
-        data: { siteId: string; workspaceId: string };
-      };
-      expect(data.siteId).toBe(F);
-      expect(data.workspaceId).toBe(F);
-    });
-  });
-});

package/templates/apps/api/src/routes/leads/__tests__/track.test.ts

@@ -1,165 +0,0 @@
-/**
- * @file track.test.ts
- * Verifies that track('lead-captured', ...) fires after successful persistence
- * and does NOT fire on validation/persistence failure.
- *
- * Real dependencies (Issue #507):
- *   - appendLeadRecord (lead-capture-store): real — writes to LEAD_CAPTURE_FILE temp file
- *   - writeLeadFallback (file-fallback): real — writes to AILK_INBOX_FALLBACK_DIR temp dir
- *   - enrichLead (enrichment-shim): real — pass-through shim
- *
- * Mocked:
- *   - @working-theory/analytics/server: external package boundary — stays mocked
- *   - prisma (lib/prisma.js): manual mock via __mocks__/prisma.ts
- *   - @working-theory/email: external package boundary — stays mocked
- *   - @working-theory/license: consumed by enrichment-shim; stays mocked
- */
-
-import type { FastifyInstance } from "fastify";
-
-const mockTrack = jest.fn().mockResolvedValue(undefined);
-
-jest.mock("@working-theory/analytics/server", () => ({
-  track: (...args: unknown[]) => mockTrack(...args),
-}));
-
-// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock (Jest requires explicit call for local files)
-jest.mock("../../../lib/prisma.js");
-
-jest.mock("@working-theory/email", () => ({
-  sendLeadNotification: jest
-    .fn()
-    .mockResolvedValue({ ok: true, messageId: "msg-test" }),
-}));
-
-// @working-theory/license: consumed transitively by enrichment-shim; mocked to avoid
-// needing a license key in tests.
-jest.mock("@working-theory/license", () => ({
-  checkLicense: jest.fn().mockResolvedValue({
-    tier: "free",
-    plan: null,
-    features: [],
-    expiresAt: null,
-    revoked: false,
-  }),
-}));
-
-import { leadSubmitRoute } from "../index";
-import { prisma } from "../../../lib/prisma.js";
-import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
-
-setupLeadFileEnv("track");
-
-// ─── Suite setup ──────────────────────────────────────────────────────────────
-
-describe("POST /api/leads — track() telemetry", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    process.env.AILK_LEAD_NOTIFICATION_TO = "owner@example.com";
-    process.env.AILK_LEAD_NOTIFICATION_FROM = "noreply@example.com";
-    process.env.DATABASE_URL = "postgres://stub";
-
-    const fastify = require("fastify")();
-    await fastify.register(leadSubmitRoute);
-    app = fastify;
-  });
-
-  afterEach(async () => {
-    await app.close();
-    delete process.env.AILK_LEAD_NOTIFICATION_TO;
-    delete process.env.AILK_LEAD_NOTIFICATION_FROM;
-    delete process.env.DATABASE_URL;
-  });
-
-  it("calls track('lead-captured') with source and locale on successful submission", async () => {
-    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000b1";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      payload: {
-        kind: "submit",
-        siteId: "site-abc",
-        source: "newsletter",
-        email: "test@example.com",
-        payload: { locale: "en-US" },
-      },
-    });
-
-    if (res.statusCode === 201) {
-      expect(mockTrack).toHaveBeenCalledTimes(1);
-      expect(mockTrack).toHaveBeenCalledWith(
-        "lead-captured",
-        expect.objectContaining({ source: "newsletter" }),
-      );
-    }
-  });
-
-  it("does NOT call track() when both DB and file fallback fail (persist_failed → 503)", async () => {
-    (prisma.lead.create as jest.Mock).mockRejectedValue(
-      new Error("DB connection refused"),
-    );
-
-    // Make the real writeLeadFallback fail by pointing it at a non-writable path.
-    process.env.AILK_INBOX_FALLBACK_DIR = "/nonexistent-readonly-path-ailk-test";
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      payload: {
-        kind: "submit",
-        siteId: "site-abc",
-        source: "contact",
-        email: "fail@example.com",
-        payload: {},
-      },
-    });
-
-    expect(res.statusCode).toBe(503);
-    expect(mockTrack).not.toHaveBeenCalled();
-  });
-
-  it("does NOT call track() when validation fails (missing required field → 400 or 503)", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      payload: {
-        // missing email — required field for lead kind
-        kind: "submit",
-        siteId: "site-abc",
-        source: "contact",
-        payload: {},
-      },
-    });
-
-    // The route may return 400 (invalid_input) or 503 (config_missing).
-    expect(mockTrack).not.toHaveBeenCalled();
-  });
-
-  it("track() props contain only source and locale — no PII fields", async () => {
-    const serverGeneratedId = "lead_00000000-0000-7000-8000-0000000000b2";
-    (prisma.lead.create as jest.Mock).mockResolvedValue({ id: serverGeneratedId });
-
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/leads/submit",
-      payload: {
-        kind: "submit",
-        siteId: "site-abc",
-        source: "landing-page",
-        email: "pii@example.com",
-        payload: { name: "Alice" },
-      },
-    });
-
-    if (res.statusCode === 201 && mockTrack.mock.calls.length > 0) {
-      const [, props] = mockTrack.mock.calls[0];
-      expect(props).not.toHaveProperty("email");
-      expect(props).not.toHaveProperty("name");
-      expect(props).not.toHaveProperty("ip");
-    }
-  });
-});