create-ailk 0.24.0 → 0.25.1

package/templates/apps/api/src/services/lead-promotion.ts

@@ -1,160 +0,0 @@
-/**
- * @file lead-promotion.ts
- * @description Lead → user promotion across the inbox/auth namespace boundary
- * (ADR 0009 D3 service-layer pattern; spec
- * docs/specs/3586-lead-user-promotion-spec.md).
- *
- * Reconciles an anonymous inbox.Lead with an auth.User by stable email, once
- * the reconciling user's own email is verified (D2 — the consent basis for
- * linking anonymous-lead PII to a user) and only within that user's own
- * tenant workspaces (D3 — the tenant-safety invariant). Workspace resolution
- * is delegated to `owner-workspaces.ts` — the one site→workspace resolution in
- * this app, which in turn delegates to the sole cross-namespace tenancy
- * assembler — so this file never issues a raw membership or workspace model
- * query of its own (architecture.yaml's tenant-scope forbidden pattern
- * reserves those to the tenant-context / tenant-db modules).
- *
- * Mirrors lead-routing.ts's shape: discriminated `{ ok } | { ok: false, error }`
- * result, no throw on the expected (no-op) paths, PII-safe (never logs email /
- * payload / name / phone).
- */
-
-import type { Id } from "@working-theory/ids";
-
-import { prisma } from "../lib/prisma.js";
-
-import { resolveOwnerWorkspaces } from "./owner-workspaces.js";
-import { findVerifiedEmail } from "./verified-email.js";
-
-/**
- * Workspace resolution moved to `owner-workspaces.ts` (#5678) so the leads
- * READ path can share it rather than write a second one. The module-
- * conditional slice load, the zero-workspace semantics and the delegation to
- * the tenancy assembler are unchanged — this file simply calls it now.
- *
- * It had to be a separate module rather than an export from here:
- * `paidModuleTemplateExclusions()` drops every file that reaches a paid
- * module's `ownedFiles` through the import graph, this file is inside that
- * closure, and importing it from the leads read would have carried the
- * closure all the way into `server.ts`. See `owner-workspaces.ts`'s own
- * header.
- *
- * Semantics on a build without the multi-tenant module, CORRECTED by #5677
- * and carried across the move. `services/default-tenant.ts` now resolves the
- * seeded default Workspace on every build, so a module-less deployment DOES
- * have a resolvable workspace — the shared resolver's empty result there is a
- * deliberate scope limit, not a statement that there is nothing to resolve.
- *
- * PROMOTION specifically is not wired to that default resolution, and that is
- * #5677's own disposition rather than an oversight of this move: single-tenant
- * leads would start acquiring `promotedUserId`, which is what
- * `/v1/flow-checkouts/me` and `/v1/waitlist-signups/me` join a respondent's own
- * rows through — a respondent's `/account` would begin showing purchases where
- * it shows none today. It also needs the deployment to pin `AILK_SITE_ID` to
- * `DEFAULT_WORKSPACE_ID`, because `siteId` comes from `lib/site.ts`
- * (`AILK_SITE_ID ?? "default"`) while `workspaceId` is the sentinel, and
- * `siteId ∈ workspaceIds` only matches when those agree.
- */
-
-// ─── Types ────────────────────────────────────────────────────────────────────
-
-export type PromotedLead = {
-  leadId: string;
-  siteId: string;
-  source: string;
-};
-
-export type PromoteLeadsResult =
-  | { ok: true; count: number; promoted: PromotedLead[] }
-  | {
-      ok: false;
-      error: { kind: "user_not_found" | "internal_error"; message: string };
-    };
-
-// ─── Main export ──────────────────────────────────────────────────────────────
-
-/**
- * Promote every un-promoted `inbox.Lead` matching the verifying user's own
- * email, within that user's own tenant workspaces (D1/D3). No-ops
- * (`count: 0`) — never throws — when: the user's email is unverified (D2),
- * the user belongs to no workspace, or no matching un-promoted lead exists.
- * Idempotent: a lead already carrying `promotedUserId` is excluded from the
- * match set, so re-invocation promotes nothing (AC-6).
- */
-export async function promoteLeadsForVerifiedUser(params: {
-  userId: string;
-}): Promise<PromoteLeadsResult> {
-  const { userId } = params;
-
-  try {
-    // D2 — the verified-email gate is a service-level invariant, not a
-    // caller obligation: it cannot be bypassed by a wrong call-site. The read
-    // and the refusal both live in `services/verified-email.ts` (#5701 D4),
-    // shared with the four other email-keyed paths.
-    const verified = await findVerifiedEmail(userId);
-    if (!verified.ok) {
-      if (verified.reason === "user_not_found") {
-        return {
-          ok: false,
-          error: { kind: "user_not_found", message: "User not found" },
-        };
-      }
-      return { ok: true, count: 0, promoted: [] };
-    }
-    const user = verified.value;
-
-    // D3/D4 — resolve the verifying user's OWN workspaces through the one
-    // shared resolution (`owner-workspaces.ts`). Role-agnostic here:
-    // promotion links a lead to the person whose verified email it carries,
-    // in any workspace they belong to, exactly as it did before the move.
-    // Without the multi-tenant module the shared resolver yields nothing and
-    // the early return below fires — a scope limit since #5677, not an
-    // absence of anything to resolve; see the header.
-    const workspaces = await resolveOwnerWorkspaces(user.id as Id<"user">);
-    if (!workspaces.ok) {
-      return {
-        ok: false,
-        error: { kind: "internal_error", message: workspaces.error.message },
-      };
-    }
-    const workspaceIds = workspaces.value.map((workspace) => workspace.id);
-
-    if (workspaceIds.length === 0) {
-      return { ok: true, count: 0, promoted: [] };
-    }
-
-    // D3/AC-4 (tenant-safety — load-bearing): the match set is siteId ∈ the
-    // user's OWN workspaceIds, so a lead captured under a different
-    // organization's workspace is never matched, by construction.
-    const candidates = await prisma.lead.findMany({
-      where: {
-        email: user.email,
-        siteId: { in: workspaceIds },
-        promotedUserId: null,
-      },
-      select: { id: true, siteId: true, source: true },
-    });
-
-    if (candidates.length === 0) {
-      return { ok: true, count: 0, promoted: [] };
-    }
-
-    await prisma.lead.updateMany({
-      where: { id: { in: candidates.map((lead) => lead.id) } },
-      data: { promotedUserId: user.id, promotedAt: new Date() },
-    });
-
-    return {
-      ok: true,
-      count: candidates.length,
-      promoted: candidates.map((lead) => ({
-        leadId: lead.id,
-        siteId: lead.siteId,
-        source: lead.source,
-      })),
-    };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    return { ok: false, error: { kind: "internal_error", message } };
-  }
-}