create-ailk 0.23.0 → 0.25.1

package/templates/apps/api/src/routes/project-listings/__tests__/me.test.ts

@@ -1,480 +0,0 @@
-// Not marked oss: false (D-48/#5366 escalation) — tests the
-// always-shipping project-listings anonymous surface; see
-// routes/project-listings/me.ts's header comment.
-/**
- * @file me.test.ts
- *
- * THE ACCEPTANCE GATE for the founder's own listings read (#5295).
- * Registration mirrors server.ts: REAL `authPreHandlerPlugin ->
- * projectListingMeRoute` (auth only, NO tenant guard), mocked `lib/prisma.js`.
- *
- * Proves the security properties the owner link exists for:
- *   - two users sharing a `founderEmail` value never see each other's rows;
- *   - a row whose owner link was never set is invisible to the person whose
- *     address it carries — the read never falls back to an email comparison;
- *   - the `where` clause carries `ownerUserId` and nothing resembling an email
- *     (a clause carrying one is treated as a contract violation and returns
- *     nothing, the `flow-checkouts` test's own discipline);
- *   - a signed-in caller who owns nothing gets `200 []`, never a 403;
- *   - the tenant routes' permission (`inbox-read`, #7636 D2) is untouched and
- *     this route never consults it.
- */
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-import { PERMISSION_TABLE, projectListingMeResponseSchema } from "@working-theory/validation";
-
-// `services/project-listings.ts` imports `routeLead` from `lead-routing.js` at
-// module scope, which transitively imports `@working-theory/email` and
-// `@working-theory/license` — mocked here purely so that import chain resolves,
-// mirroring `tenant-isolation.test.ts`'s discipline.
-jest.mock("@working-theory/email", () => ({
-  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
-}));
-jest.mock("@working-theory/license", () => ({
-  checkLicense: jest.fn().mockResolvedValue({
-    tier: "free",
-    plan: null,
-    features: [],
-    expiresAt: null,
-    revoked: false,
-  }),
-}));
-
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../../lib/prisma.js", () => ({
-  prisma: {
-    session: { findUnique: jest.fn() },
-    apiToken: {
-      findUnique: jest.fn(),
-      update: jest.fn().mockResolvedValue(undefined),
-    },
-    user: { findUnique: jest.fn() },
-    projectListing: { findMany: jest.fn() },
-    waitlistScore: { count: jest.fn() },
-  },
-}));
-
-import { prisma } from "../../../lib/prisma.js";
-import { authPreHandlerPlugin } from "../../../middleware/auth.js";
-import { projectListingMeRoute } from "../index.js";
-
-const FRONTEND = "https://app.example.com";
-const FUTURE = new Date(Date.now() + 60 * 60 * 1000);
-
-const SITE_A = "wksp_00000000-0000-7000-8000-000000000001";
-const SITE_B = "wksp_00000000-0000-7000-8000-000000000002";
-
-/**
- * `ada` and `bruno` are TWO DIFFERENT PEOPLE who typed the SAME address into
- * the anonymous application form. That is the whole point: `founderEmail` is
- * not an identity, and nothing may derive ownership from it.
- */
-const SHARED_EMAIL = "founder@example.com";
-
-const USERS: Record<string, { id: string; email: string; emailVerified: boolean }> = {
-  ada: { id: "ada", email: SHARED_EMAIL, emailVerified: true },
-  bruno: { id: "bruno", email: SHARED_EMAIL, emailVerified: true },
-  // Signed in, verified, owns nothing at all.
-  cleo: { id: "cleo", email: "cleo@example.com", emailVerified: true },
-  // Signed in with an address that was never verified, and whose own listing
-  // WAS linked earlier. See the test that covers this case.
-  dane: { id: "dane", email: "dane@example.com", emailVerified: false },
-};
-
-const SESSION_ROWS: Record<string, Record<string, unknown>> = {
-  cookie_ada: { id: "sess_ada", userId: "ada", expiresAt: FUTURE, activeOrganizationId: null, activeWorkspaceId: null },
-  cookie_bruno: { id: "sess_bruno", userId: "bruno", expiresAt: FUTURE, activeOrganizationId: null, activeWorkspaceId: null },
-  cookie_cleo: { id: "sess_cleo", userId: "cleo", expiresAt: FUTURE, activeOrganizationId: null, activeWorkspaceId: null },
-  cookie_dane: { id: "sess_dane", userId: "dane", expiresAt: FUTURE, activeOrganizationId: null, activeWorkspaceId: null },
-};
-
-type ListingFixture = {
-  id: string;
-  siteId: string;
-  founderEmail: string;
-  ownerUserId: string | null;
-  experimentKey: string | null;
-  createdAt: Date;
-};
-
-/** A complete stored row at `PROJECT_LISTING_SELECT`'s shape. */
-function row(fixture: ListingFixture) {
-  return {
-    id: fixture.id,
-    siteId: fixture.siteId,
-    leadId: `lead_${fixture.id}`,
-    slug: fixture.id.replace("prjl_", ""),
-    name: "Atlas",
-    oneLiner: "A one-liner.",
-    problem: "A problem.",
-    url: "https://atlas.example.com",
-    product: "live-some-users",
-    commitment: "full-time",
-    teamComposition: "just-me",
-    faqs: null,
-    anythingElse: null,
-    address: "1 Main St",
-    addressLine1: null,
-    addressLine2: null,
-    addressCity: null,
-    addressRegion: null,
-    addressPostalCode: null,
-    addressCountry: null,
-    questions: null,
-    siteAnswers: null,
-    windowDays: 30,
-    founderName: "A Founder",
-    founderEmail: fixture.founderEmail,
-    // #5407 — a row written before the columns existed, and a freshly
-    // started draft on a site that asks for one name line: parts null,
-    // no phone, no verification stamp.
-    founderFirstName: null,
-    founderLastName: null,
-    founderPhone: null,
-    emailVerifiedAt: null,
-    founderCompany: null,
-    headline: "Atlas",
-    logoMarkUrl: null,
-    logoWordmarkUrl: null,
-    solution: null,
-    featured: false,
-    status: "requested",
-    consentAt: fixture.createdAt,
-    decidedAt: null,
-    decidedBy: "operator@example.com",
-    issueUrl: "https://github.com/example/repo/issues/1",
-    experimentKey: fixture.experimentKey,
-    windowEndsAt: null,
-    createdAt: fixture.createdAt,
-    updatedAt: fixture.createdAt,
-  };
-}
-
-const LISTINGS: ListingFixture[] = [
-  // ada's own, linked to ada.
-  {
-    id: "prjl_ada_one",
-    siteId: SITE_A,
-    founderEmail: SHARED_EMAIL,
-    ownerUserId: "ada",
-    experimentKey: "atlas-waitlist",
-    createdAt: new Date("2026-09-01T00:00:00.000Z"),
-  },
-  // ada again, NEWER, and in a SECOND workspace of ada's — proves the per-site
-  // waitlistCount resolution and the newest-first ordering.
-  {
-    id: "prjl_ada_two",
-    siteId: SITE_B,
-    founderEmail: SHARED_EMAIL,
-    ownerUserId: "ada",
-    experimentKey: "atlas-two-waitlist",
-    createdAt: new Date("2026-09-05T00:00:00.000Z"),
-  },
-  // bruno's own — SAME founderEmail as ada's rows, different person.
-  {
-    id: "prjl_bruno_one",
-    siteId: SITE_A,
-    founderEmail: SHARED_EMAIL,
-    ownerUserId: "bruno",
-    experimentKey: null,
-    createdAt: new Date("2026-09-03T00:00:00.000Z"),
-  },
-  // Carries the shared address and was NEVER linked. Invisible to everyone.
-  {
-    id: "prjl_unlinked",
-    siteId: SITE_A,
-    founderEmail: SHARED_EMAIL,
-    ownerUserId: null,
-    experimentKey: null,
-    createdAt: new Date("2026-09-04T00:00:00.000Z"),
-  },
-  // dane's own, linked while dane's address was still verified.
-  {
-    id: "prjl_dane_one",
-    siteId: SITE_A,
-    founderEmail: "dane@example.com",
-    ownerUserId: "dane",
-    experimentKey: null,
-    createdAt: new Date("2026-09-02T00:00:00.000Z"),
-  },
-];
-
-type ListingWhere = Record<string, unknown> & { ownerUserId?: unknown };
-
-const WAITLIST_COUNTS: Record<string, Record<string, number>> = {
-  [SITE_A]: { "atlas-waitlist": 7 },
-  [SITE_B]: { "atlas-two-waitlist": 3 },
-};
-
-function installFixtureMocks(): void {
-  (prisma.session.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { token?: string } }) =>
-      Promise.resolve(where.token ? (SESSION_ROWS[where.token] ?? null) : null),
-  );
-  (prisma.apiToken.findUnique as jest.Mock).mockResolvedValue(null);
-  (prisma.user.findUnique as jest.Mock).mockImplementation(({ where }: { where: { id: string } }) =>
-    Promise.resolve(USERS[where.id] ?? null),
-  );
-
-  /**
-   * The owner link is the ONLY join the service may use, and this mock is
-   * written to FAIL on a regression rather than to absorb one.
-   *
-   * Two earlier, weaker forms were rejected during review, both of which let a
-   * regression keep the security tests green:
-   *
-   *   - `expect(where).not.toHaveProperty("founderEmail")` inspects TOP-LEVEL
-   *     keys only, so an `OR`-wrapped email fallback
-   *     (`{ OR: [{ ownerUserId }, { founderEmail }] }`) sails straight past it —
-   *     and a mock that then filtered on `where.ownerUserId` returns `[]` for
-   *     that shape, which looks like "nothing leaked".
-   *   - Filtering on `where.ownerUserId` when it is `undefined` also returns
-   *     `[]`, while Prisma compiles an `undefined` filter to no filter at all
-   *     (`WHERE 1=1`) and the REAL read would be unscoped.
-   *
-   * So: any key other than `ownerUserId` THROWS, an `ownerUserId` that is not a
-   * string THROWS, and the filter is exact equality on it. A widened read now
-   * fails as a thrown error rather than as a quietly empty result.
-   */
-  (prisma.projectListing.findMany as jest.Mock).mockImplementation(
-    ({ where }: { where: ListingWhere }) => {
-      const keys = Object.keys(where);
-      if (keys.length !== 1 || keys[0] !== "ownerUserId") {
-        throw new Error(
-          `the /me read must scope on ownerUserId and nothing else; got where keys [${keys.join(", ")}]`,
-        );
-      }
-      if (typeof where.ownerUserId !== "string") {
-        throw new Error(
-          "ownerUserId must be a concrete string; Prisma compiles an undefined filter to no filter, leaving the read unscoped",
-        );
-      }
-      const ownerUserId = where.ownerUserId;
-      return Promise.resolve(
-        LISTINGS.filter((l) => l.ownerUserId === ownerUserId)
-          .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())
-          .map(row),
-      );
-    },
-  );
-
-  (prisma.waitlistScore.count as jest.Mock).mockImplementation(
-    ({ where }: { where: { siteId: string; experimentKey: string } }) =>
-      Promise.resolve(WAITLIST_COUNTS[where.siteId]?.[where.experimentKey] ?? 0),
-  );
-}
-
-async function buildApp(): Promise<FastifyInstance> {
-  const app = Fastify();
-  await app.register(async (authScope) => {
-    await authScope.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
-    await authScope.register(projectListingMeRoute);
-  });
-  await app.ready();
-  return app;
-}
-
-const cookie = (token: string) => ({ cookie: `better-auth.session_token=${token}` });
-const URL_ME = "/v1/project-listings/me";
-
-const listingWhere = (call = 0) =>
-  (prisma.projectListing.findMany as jest.Mock).mock.calls[call][0].where as ListingWhere;
-
-let app: FastifyInstance;
-
-beforeEach(async () => {
-  jest.clearAllMocks();
-  installFixtureMocks();
-  app = await buildApp();
-});
-
-afterEach(async () => {
-  await app.close();
-});
-
-describe("GET /v1/project-listings/me — auth", () => {
-  it("no session cookie and no bearer → the preHandler's existing 401; no listing read", async () => {
-    const res = await app.inject({ method: "GET", url: URL_ME });
-
-    expect(res.statusCode).toBe(401);
-    expect(prisma.projectListing.findMany).not.toHaveBeenCalled();
-  });
-
-  it("an expired / unknown cookie → 401", async () => {
-    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_nobody") });
-
-    expect(res.statusCode).toBe(401);
-    expect(prisma.projectListing.findMany).not.toHaveBeenCalled();
-  });
-});
-
-describe("GET /v1/project-listings/me — the owner link is the only join", () => {
-  /** SECURITY PROPERTY: two users sharing a founderEmail value. */
-  it("two users sharing a founderEmail never see each other's listings", async () => {
-    const adaRes = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
-    const brunoRes = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_bruno") });
-
-    expect(adaRes.statusCode).toBe(200);
-    expect(brunoRes.statusCode).toBe(200);
-
-    const adaIds = (adaRes.json().data as Array<{ id: string }>).map((r) => r.id);
-    const brunoIds = (brunoRes.json().data as Array<{ id: string }>).map((r) => r.id);
-
-    // ada sees her two rows, newest first, and NOT bruno's.
-    expect(adaIds).toEqual(["prjl_ada_two", "prjl_ada_one"]);
-    // bruno sees his one row, and NOT ada's — though every row in play carries
-    // the identical founderEmail.
-    expect(brunoIds).toEqual(["prjl_bruno_one"]);
-
-    expect(adaIds).not.toContain("prjl_bruno_one");
-    expect(brunoIds).not.toContain("prjl_ada_one");
-    expect(brunoIds).not.toContain("prjl_ada_two");
-    // And neither of them reaches the un-linked row carrying the same address.
-    expect([...adaIds, ...brunoIds]).not.toContain("prjl_unlinked");
-  });
-
-  /** SECURITY PROPERTY: no read-time email fallback. */
-  it("a listing carrying the caller's own address but NO owner link is never returned", async () => {
-    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
-
-    const ids = (res.json().data as Array<{ id: string }>).map((r) => r.id);
-    expect(ids).not.toContain("prjl_unlinked");
-  });
-
-  it("the where clause is the owner link and carries nothing email-shaped", async () => {
-    await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
-
-    expect(listingWhere()).toEqual({ ownerUserId: "ada" });
-  });
-
-  it("a query parameter is never read — ?email= and ?ownerUserId= change nothing", async () => {
-    const res = await app.inject({
-      method: "GET",
-      url: `${URL_ME}?email=${encodeURIComponent(SHARED_EMAIL)}&ownerUserId=bruno`,
-      headers: cookie("cookie_ada"),
-    });
-
-    expect(res.statusCode).toBe(200);
-    // Still ada's own rows, scoped by the SESSION's user id.
-    expect(listingWhere()).toEqual({ ownerUserId: "ada" });
-    expect((res.json().data as Array<{ id: string }>).map((r) => r.id)).toEqual([
-      "prjl_ada_two",
-      "prjl_ada_one",
-    ]);
-  });
-});
-
-describe("GET /v1/project-listings/me — the empty case is not a refusal", () => {
-  /** SECURITY / UX PROPERTY: owning nothing is an empty list, never a 403. */
-  it("a signed-in caller who owns no listing gets 200 with an empty list, not a 403", async () => {
-    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_cleo") });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.json()).toEqual({ ok: true, data: [] });
-    // Specifically NOT the tenant routes' 403 — cleo is legitimately signed in.
-    expect(res.statusCode).not.toBe(403);
-  });
-
-  it("no waitlist count is read when the caller owns nothing", async () => {
-    await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_cleo") });
-
-    expect(prisma.waitlistScore.count).not.toHaveBeenCalled();
-  });
-});
-
-describe("GET /v1/project-listings/me — the response shape", () => {
-  it("every row parses under projectListingMeResponseSchema", async () => {
-    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
-
-    expect(res.statusCode).toBe(200);
-    const parsed = projectListingMeResponseSchema.safeParse(res.json().data);
-    expect(parsed.success).toBe(true);
-  });
-
-  it("the five internal references never reach the founder", async () => {
-    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
-
-    for (const listing of res.json().data as Array<Record<string, unknown>>) {
-      expect(listing).not.toHaveProperty("siteId");
-      expect(listing).not.toHaveProperty("leadId");
-      expect(listing).not.toHaveProperty("decidedBy");
-      expect(listing).not.toHaveProperty("issueUrl");
-      expect(listing).not.toHaveProperty("experimentKey");
-    }
-    // No workspace id reaches the wire anywhere in the body.
-    expect(res.body).not.toContain(SITE_A);
-    expect(res.body).not.toContain(SITE_B);
-  });
-
-  it("waitlistCount is resolved per site, not all under one site id", async () => {
-    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
-
-    const byId = Object.fromEntries(
-      (res.json().data as Array<{ id: string; waitlistCount: number }>).map((r) => [
-        r.id,
-        r.waitlistCount,
-      ]),
-    );
-    // prjl_ada_one's experiment lives at SITE_A (7); prjl_ada_two's at SITE_B (3).
-    // One shared site id would have reported 0 for one of them.
-    expect(byId["prjl_ada_one"]).toBe(7);
-    expect(byId["prjl_ada_two"]).toBe(3);
-    expect(prisma.waitlistScore.count).toHaveBeenCalledWith({
-      // #6258 AC-6 — the fenced read now filters the CONSTRAINED column beside
-      // `siteId`; the two are equal by the workspace_site_agree CHECK.
-      where: { siteId: SITE_A, workspaceId: SITE_A, experimentKey: "atlas-waitlist" },
-    });
-    expect(prisma.waitlistScore.count).toHaveBeenCalledWith({
-      where: { siteId: SITE_B, workspaceId: SITE_B, experimentKey: "atlas-two-waitlist" },
-    });
-  });
-
-  it("the founder's own email is echoed back to the founder who wrote it", async () => {
-    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_bruno") });
-
-    expect((res.json().data as Array<{ founderEmail: string }>)[0]?.founderEmail).toBe(
-      SHARED_EMAIL,
-    );
-  });
-});
-
-describe("GET /v1/project-listings/me — the read-time verification posture", () => {
-  /**
-   * A caller whose address is no longer verified still reads the rows their
-   * link already covers. This is deliberate, and it is the one place this route
-   * diverges from `/v1/flow-checkouts/me`, which re-checks `emailVerified`.
-   *
-   * The re-check is load-bearing on `/v1/waitlist-signups/me`, where the match
-   * IS an email, and it is defence in depth on `/v1/flow-checkouts/me`. Here it
-   * would be neither: the link is the proof, it was only ever issuable under
-   * verification, and refusing on a later unverified address would hide rows
-   * the caller already proved they own (changing your email address is not a
-   * reason to lose your own submissions). An unverified address still cannot
-   * CREATE a link — `listing-promotion.ts` refuses before any listing read.
-   */
-  it("a caller whose address is no longer verified still reads the rows their link already covers", async () => {
-    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_dane") });
-
-    expect(res.statusCode).toBe(200);
-    expect((res.json().data as Array<{ id: string }>).map((r) => r.id)).toEqual([
-      "prjl_dane_one",
-    ]);
-    expect(listingWhere()).toEqual({ ownerUserId: "dane" });
-  });
-});
-
-describe("the existing operator role floor is untouched", () => {
-  it("the tenant routes read the permission table's inbox-read row, which holds every Membership role", () => {
-    expect([...PERMISSION_TABLE["inbox-read"]].sort()).toEqual(["admin", "member", "owner"]);
-  });
-
-  it("the /me route never consults the tenant context or the role floor", async () => {
-    // The app this suite builds registers NO tenant preHandler at all, so
-    // `request.tenant` is undefined for every request above. That every test in
-    // this file answers 200 is the proof: a route that consulted the floor
-    // would have answered 401/403 instead.
-    const res = await app.inject({ method: "GET", url: URL_ME, headers: cookie("cookie_ada") });
-
-    expect(res.statusCode).toBe(200);
-  });
-});