create-ailk 0.24.0 → 0.25.1

package/templates/apps/api/src/services/__tests__/consent.test.ts

@@ -1,299 +0,0 @@
-/**
- * @file consent.test.ts
- * @description Unit tests for the consent-grant writer (#5275 Part B) —
- * `recordConsent`, `recordLegacyConsent`, `consentStatementHash`,
- * `consentConfigForSite`.
- *
- * External dependency boundaries mocked:
- *   - @working-theory/database (via moduleNameMapper -> prisma-client.js mock; prisma singleton via __mocks__/prisma.ts)
- *
- * The evidence rule under test: a row carries the statement the registry
- * RESOLVED (the same function the renderer used), in the locale it was
- * actually served, or the unrecoverable sentinel — never anything a request
- * body said and never today's wording for a grant nobody read.
- */
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../../lib/prisma.js");
-
-import { createHash } from "node:crypto";
-
-import {
-  DEFAULT_CONSENT_PURPOSE_ID,
-  resolveConsentStatement,
-  SITE_CONSENT_CONFIG_DEFAULTS,
-  siteConsentConfigSchema,
-} from "@working-theory/validation";
-
-import { prisma } from "../../lib/prisma.js";
-
-import {
-  consentConfigForSite,
-  consentStatementHash,
-  recordConsent,
-  recordLegacyConsent,
-  UNRECOVERABLE_CONSENT_LOCALE,
-  UNRECOVERABLE_CONSENT_STATEMENT,
-  requiredConsentUnmet,
-} from "../consent";
-
-const SITE_ID = "site-1";
-const SUBJECT = {
-  subjectType: "project_listing",
-  subjectId: "prjl_00000000-0000-7000-8000-000000000001",
-  personId: null,
-  source: "api" as const,
-};
-
-/** Two purposes, one of them bilingual — the fixture every locale case reads from. */
-const CONFIG = siteConsentConfigSchema.parse({
-  policies: { terms: "/terms", privacy: "/privacy" },
-  purposes: [
-    {
-      id: "service_terms",
-      required: true,
-      label: {
-        en: "You agree to our [Terms](terms).",
-        fr: "Vous acceptez nos [Conditions](terms).",
-      },
-    },
-    {
-      id: "marketing_email",
-      required: false,
-      label: { en: "Send me occasional product news." },
-    },
-  ],
-});
-
-type Row = Record<string, unknown>;
-
-function writtenRows(call = 0): Row[] {
-  const arg = (prisma.consentGrant.createMany as jest.Mock).mock.calls[call]![0] as { data: Row[] };
-  return arg.data;
-}
-
-describe("recordConsent (#5275)", () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-    (prisma.consentGrant.createMany as jest.Mock).mockImplementation(
-      ({ data }: { data: Row[] }) => Promise.resolve({ count: data.length }),
-    );
-  });
-
-  it("one granted + one declined purpose → ONE createMany with two rows, one granted:true and one granted:false (D8)", async () => {
-    const written = await recordConsent({
-      siteId: SITE_ID,
-      ...SUBJECT,
-      locale: "en",
-      config: CONFIG,
-      consents: { service_terms: true, marketing_email: false },
-    });
-
-    expect(written).toBe(2);
-    expect(prisma.consentGrant.createMany).toHaveBeenCalledTimes(1);
-    const rows = writtenRows();
-    expect(rows).toHaveLength(2);
-    expect(rows.find((r) => r["purposeId"] === "service_terms")).toMatchObject({
-      siteId: SITE_ID,
-      ...SUBJECT,
-      granted: true,
-    });
-    expect(rows.find((r) => r["purposeId"] === "marketing_email")).toMatchObject({
-      siteId: SITE_ID,
-      ...SUBJECT,
-      granted: false,
-    });
-  });
-
-  it("each row carries the RESOLVED statement text and the locale it was actually served in (D7)", async () => {
-    // `fr-CA` is asked for; the bilingual purpose serves `fr` (language-subtag
-    // fallback), the English-only purpose serves `en` (default-locale
-    // fallback). The row records the locale READ, not the one requested.
-    await recordConsent({
-      siteId: SITE_ID,
-      ...SUBJECT,
-      locale: "fr-CA",
-      config: CONFIG,
-      consents: { service_terms: true, marketing_email: true },
-    });
-
-    const rows = writtenRows();
-    const terms = rows.find((r) => r["purposeId"] === "service_terms")!;
-    const marketing = rows.find((r) => r["purposeId"] === "marketing_email")!;
-
-    const expectedTerms = resolveConsentStatement(CONFIG.purposes[0]!, "fr-CA");
-    expect(expectedTerms.locale).toBe("fr");
-    expect(terms["statement"]).toBe("Vous acceptez nos [Conditions](terms).");
-    expect(terms["statement"]).toBe(expectedTerms.statement);
-    expect(terms["locale"]).toBe("fr");
-    expect(terms["statementHash"]).toBe(consentStatementHash(expectedTerms.statement));
-
-    expect(marketing["statement"]).toBe("Send me occasional product news.");
-    expect(marketing["locale"]).toBe("en");
-    expect(marketing["locale"]).not.toBe("fr-CA");
-  });
-
-  it("a second recordConsent for the same subject + purpose APPENDS — createMany again, never update/upsert (D9)", async () => {
-    const input = {
-      siteId: SITE_ID,
-      ...SUBJECT,
-      locale: "en",
-      config: CONFIG,
-      consents: { marketing_email: true },
-    };
-    await recordConsent(input);
-    await recordConsent({ ...input, consents: { marketing_email: false } });
-
-    expect(prisma.consentGrant.createMany).toHaveBeenCalledTimes(2);
-    expect(writtenRows(0)[0]).toMatchObject({ purposeId: "marketing_email", granted: true });
-    expect(writtenRows(1)[0]).toMatchObject({ purposeId: "marketing_email", granted: false });
-    // The mock delegate deliberately exposes no mutating method: the writer
-    // has nothing to update or upsert WITH, so append is structural.
-    const delegate = prisma.consentGrant as Record<string, unknown>;
-    expect(delegate["update"]).toBeUndefined();
-    expect(delegate["upsert"]).toBeUndefined();
-    expect(delegate["updateMany"]).toBeUndefined();
-  });
-
-  it("an unknown purpose id writes NOTHING for it — no statement was rendered (evidence rule)", async () => {
-    const written = await recordConsent({
-      siteId: SITE_ID,
-      ...SUBJECT,
-      locale: "en",
-      config: CONFIG,
-      consents: { service_terms: true, not_a_purpose: true },
-    });
-
-    expect(written).toBe(1);
-    const rows = writtenRows();
-    expect(rows).toHaveLength(1);
-    expect(rows[0]!["purposeId"]).toBe("service_terms");
-  });
-
-  it("only unknown purpose ids → no createMany at all, returns 0", async () => {
-    const written = await recordConsent({
-      siteId: SITE_ID,
-      ...SUBJECT,
-      locale: "en",
-      config: CONFIG,
-      consents: { not_a_purpose: true },
-    });
-    expect(written).toBe(0);
-    expect(prisma.consentGrant.createMany).not.toHaveBeenCalled();
-  });
-
-  it("never writes the unrecoverable sentinel when a statement was resolved", async () => {
-    await recordConsent({
-      siteId: SITE_ID,
-      ...SUBJECT,
-      locale: "en",
-      config: SITE_CONSENT_CONFIG_DEFAULTS,
-      consents: { [DEFAULT_CONSENT_PURPOSE_ID]: true },
-    });
-    const [row] = writtenRows();
-    expect(row!["statement"]).not.toBe(UNRECOVERABLE_CONSENT_STATEMENT);
-    expect(row!["locale"]).not.toBe(UNRECOVERABLE_CONSENT_LOCALE);
-  });
-});
-
-describe("recordLegacyConsent (#5275 D11)", () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-    (prisma.consentGrant.createMany as jest.Mock).mockImplementation(
-      ({ data }: { data: Row[] }) => Promise.resolve({ count: data.length }),
-    );
-  });
-
-  it("writes exactly one row: sentinel statement, locale 'und', purpose service_terms under the default config", async () => {
-    const written = await recordLegacyConsent({
-      siteId: SITE_ID,
-      ...SUBJECT,
-      config: SITE_CONSENT_CONFIG_DEFAULTS,
-    });
-
-    expect(written).toBe(1);
-    expect(prisma.consentGrant.createMany).toHaveBeenCalledTimes(1);
-    const rows = writtenRows();
-    expect(rows).toHaveLength(1);
-    expect(rows[0]).toEqual({
-      siteId: SITE_ID,
-      // #6374 — the fence's isolation key, equal to `siteId` by construction.
-      workspaceId: SITE_ID,
-      ...SUBJECT,
-      purposeId: DEFAULT_CONSENT_PURPOSE_ID,
-      granted: true,
-      locale: UNRECOVERABLE_CONSENT_LOCALE,
-      statement: UNRECOVERABLE_CONSENT_STATEMENT,
-      statementHash: consentStatementHash(UNRECOVERABLE_CONSENT_STATEMENT),
-      // #8438 D2 — the ledger fields: no Person, no magnet slug, and the
-      // registry's policy version in force.
-      sourceRef: null,
-      policyVersion: 1,
-    });
-    expect(rows[0]!["purposeId"]).toBe("service_terms");
-    expect(rows[0]!["locale"]).toBe("und");
-    // Never today's wording for a grant nobody read.
-    expect(rows[0]!["statement"]).not.toContain("You agree to being contacted");
-  });
-
-  it("targets the first REQUIRED purpose, not merely the first purpose", async () => {
-    const config = siteConsentConfigSchema.parse({
-      purposes: [
-        { id: "marketing_email", required: false, label: { en: "News." } },
-        { id: "service_terms", required: true, label: { en: "Terms." } },
-      ],
-    });
-    await recordLegacyConsent({ siteId: SITE_ID, ...SUBJECT, config });
-    expect(writtenRows()[0]!["purposeId"]).toBe("service_terms");
-  });
-
-  it("falls back to the first purpose when none is required", async () => {
-    const config = siteConsentConfigSchema.parse({
-      purposes: [{ id: "marketing_email", required: false, label: { en: "News." } }],
-    });
-    await recordLegacyConsent({ siteId: SITE_ID, ...SUBJECT, config });
-    expect(writtenRows()[0]!["purposeId"]).toBe("marketing_email");
-  });
-});
-
-describe("consentStatementHash", () => {
-  it("is sha256 hex", () => {
-    expect(consentStatementHash("abc")).toBe(
-      "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad",
-    );
-    expect(consentStatementHash(UNRECOVERABLE_CONSENT_STATEMENT)).toBe(
-      createHash("sha256").update(UNRECOVERABLE_CONSENT_STATEMENT).digest("hex"),
-    );
-    expect(consentStatementHash(UNRECOVERABLE_CONSENT_STATEMENT)).toMatch(/^[0-9a-f]{64}$/);
-  });
-});
-
-describe("consentConfigForSite", () => {
-  it("resolves every site to the platform defaults until a config row exists", async () => {
-    await expect(consentConfigForSite(SITE_ID)).resolves.toBe(SITE_CONSENT_CONFIG_DEFAULTS);
-  });
-});
-
-describe("requiredConsentUnmet (#5275, security review Medium 1)", () => {
-  const config = siteConsentConfigSchema.parse({
-    policies: {},
-    purposes: [
-      { id: "service_terms", required: true, label: { en: "a" } },
-      { id: "marketing", required: false, label: { en: "b" } },
-    ],
-  });
-
-  it("does not demand a sign-up agreement of a form that cannot show it (#8438 D13)", () => {
-    expect(
-      requiredConsentUnmet(SITE_CONSENT_CONFIG_DEFAULTS, { service_terms: true }),
-    ).toBeUndefined();
-  });
-
-  it("names a required purpose that is declined OR absent, and passes when every required one is true", () => {
-    expect(requiredConsentUnmet(config, { service_terms: false })).toBe("service_terms");
-    expect(requiredConsentUnmet(config, {})).toBe("service_terms");
-    expect(requiredConsentUnmet(config, { marketing: true })).toBe("service_terms");
-    expect(requiredConsentUnmet(config, { service_terms: true })).toBeUndefined();
-    expect(requiredConsentUnmet(config, { service_terms: true, marketing: false })).toBeUndefined();
-  });
-});

package/templates/apps/api/src/services/__tests__/default-tenant.test.ts

@@ -1,147 +0,0 @@
-/**
- * @file default-tenant.test.ts
- *
- * The one pin-match predicate both tenant guards share (#7523,
- * docs/specs/7523-a-multi-tenant-session-with-spec.md D2): `isPinnedOperator`
- * is true only when `AILK_OPERATOR_EMAIL` is set (trimmed, lowercased, a blank
- * pin counting as unset) AND the caller's VERIFIED `User.email` equals it.
- * `resolveDefaultTenantForOperator` delegates to it, so for every input the
- * predicate refuses, the base-build entry point returns `null` before
- * `resolveDefaultTenant` runs a single deployment or Membership read (AC-4).
- *
- * Mocks the module-level `prisma` singleton via the repo's manual-mock
- * convention (`apps/api/src/lib/__mocks__/prisma.ts`).
- */
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../../lib/prisma.js");
-
-import type { Id } from "@working-theory/ids";
-
-import { prisma } from "../../lib/prisma.js";
-import {
-  isPinnedOperator,
-  resolveDefaultTenantForOperator,
-} from "../default-tenant";
-
-const DEFAULT_ORG_ID = "org_00000000-0000-7000-8000-000000000001";
-const DEFAULT_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000001";
-
-const CALLER = "user_00000000-0000-7000-8000-0000000000c1" as Id<"user">;
-
-const ORIGINAL_ENV = process.env;
-
-beforeEach(() => {
-  jest.clearAllMocks();
-  process.env = { ...ORIGINAL_ENV };
-  delete process.env.AILK_OPERATOR_EMAIL;
-});
-
-afterAll(() => {
-  process.env = ORIGINAL_ENV;
-});
-
-function mockUser(row: { email: string; emailVerified: boolean } | null): void {
-  (prisma.user.findUnique as jest.Mock).mockResolvedValue(
-    row === null ? null : { id: CALLER, ...row },
-  );
-}
-
-/**
- * Every input `isPinnedOperator` refuses. `reads` is whether the refusal needs
- * the caller's `User` row — an unset or blank pin is refused before any read.
- */
-const REFUSALS: Array<{
-  label: string;
-  pin: string | undefined;
-  user: { email: string; emailVerified: boolean } | null;
-  reads: boolean;
-}> = [
-  {
-    label: "the pin is unset",
-    pin: undefined,
-    user: { email: "op@x.io", emailVerified: true },
-    reads: false,
-  },
-  {
-    label: "the pin is blank",
-    pin: "   ",
-    user: { email: "", emailVerified: true },
-    reads: false,
-  },
-  { label: "the caller has no User row", pin: "op@x.io", user: null, reads: true },
-  {
-    label: "the caller's address is the pin but unverified",
-    pin: "op@x.io",
-    user: { email: "op@x.io", emailVerified: false },
-    reads: true,
-  },
-  {
-    label: "the caller's verified address differs from the pin",
-    pin: "op@x.io",
-    user: { email: "attacker@evil.com", emailVerified: true },
-    reads: true,
-  },
-];
-
-describe("isPinnedOperator (#7523 D2)", () => {
-  for (const { label, pin, user, reads } of REFUSALS) {
-    it(`false when ${label}`, async () => {
-      if (pin !== undefined) process.env.AILK_OPERATOR_EMAIL = pin;
-      mockUser(user);
-
-      await expect(isPinnedOperator(CALLER)).resolves.toBe(false);
-      expect(prisma.user.findUnique).toHaveBeenCalledTimes(reads ? 1 : 0);
-    });
-  }
-
-  it("true when the caller's VERIFIED address equals the pin, case and surrounding whitespace normalised on both sides", async () => {
-    process.env.AILK_OPERATOR_EMAIL = "  Op@X.io  ";
-    mockUser({ email: " OP@x.IO ", emailVerified: true });
-
-    await expect(isPinnedOperator(CALLER)).resolves.toBe(true);
-    // The read is `findVerifiedEmail`'s — it names `emailVerified` beside
-    // `email`, so the match is against a proven address.
-    expect(prisma.user.findUnique).toHaveBeenCalledWith({
-      where: { id: CALLER },
-      select: { id: true, email: true, emailVerified: true },
-    });
-  });
-});
-
-describe("resolveDefaultTenantForOperator delegates to isPinnedOperator (#7523 AC-4)", () => {
-  for (const { label, pin, user } of REFUSALS) {
-    it(`null when ${label}, with no deployment read, no Membership read and no write`, async () => {
-      if (pin !== undefined) process.env.AILK_OPERATOR_EMAIL = pin;
-      mockUser(user);
-
-      await expect(resolveDefaultTenantForOperator(CALLER)).resolves.toBeNull();
-      expect(prisma.workspace.count).not.toHaveBeenCalled();
-      expect(prisma.workspace.findUnique).not.toHaveBeenCalled();
-      expect(prisma.membership.findUnique).not.toHaveBeenCalled();
-      expect(prisma.membership.create).not.toHaveBeenCalled();
-    });
-  }
-
-  it("the pinned, verified operator reaches resolveDefaultTenant and resolves the default tenant as before", async () => {
-    process.env.AILK_OPERATOR_EMAIL = "op@x.io";
-    mockUser({ email: "op@x.io", emailVerified: true });
-    (prisma.workspace.count as jest.Mock).mockResolvedValue(1);
-    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
-      id: DEFAULT_WORKSPACE_ID,
-      organizationId: DEFAULT_ORG_ID,
-    });
-    (prisma.membership.create as jest.Mock).mockResolvedValue({});
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
-      role: "owner",
-    });
-
-    await expect(resolveDefaultTenantForOperator(CALLER)).resolves.toEqual({
-      userId: CALLER,
-      organizationId: DEFAULT_ORG_ID,
-      workspaceId: DEFAULT_WORKSPACE_ID,
-      role: "owner",
-    });
-    expect(prisma.membership.findUnique).toHaveBeenCalledTimes(1);
-  });
-});