create-ailk 0.24.0 → 0.25.1

package/templates/database/__tests__/agents.db.test.ts

@@ -1,320 +0,0 @@
-/**
- * @file agents.db.test.ts
- *
- * LIVE-DATABASE proof of the agents table (#3591, spec
- * docs/specs/3591-tenant-scoped-agent-auth-secure-spec.md D1; AC-1 and AC-2's
- * cascade legs). Requires DATABASE_URL pointing at a Postgres with the
- * migrations applied — the whole suite SKIPS when DATABASE_URL is unset,
- * keeping the workspace Jest run DB-free (the repo convention; the
- * `apps/api Route Tests (Postgres)` workflow exercises it).
- *
- * Uses the `pg` driver directly, as `spoke-registry.db.test.ts` does. What it
- * proves that a mock cannot:
- *   1. The six format CHECKs reject a malformed id.
- *   2. `credential_hash` is unique.
- *   3. Deleting the responsible person's membership, the workspace or the
- *      organization deletes the agent — so a re-invited person's new
- *      membership cannot revive it.
- *   4. Deleting the membership of the person last shown the key sets
- *      `key_issued_to_membership_id` null and keeps the agent.
- *   5. Deleting the creator's user row leaves the agent (no relation).
- *   6. `grants` (#7864 D2, AC-2) defaults to empty, takes any of the seven
- *      grantable permissions (`people-read` since #852 D9,
- *      `member-pieces-manage` since #7878), and the `agents_grants_allowed`
- *      CHECK refuses anything else.
- *
- * One case needs no database and always runs: the latest migration's CHECK names
- * exactly `@working-theory/validation`'s `AGENT_GRANTABLE_PERMISSIONS`, so the
- * SQL and the TypeScript spelling of the list cannot drift (SEC-7864-G).
- */
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-
-import { AGENT_GRANTABLE_PERMISSIONS } from "@working-theory/validation";
-import { Client } from "pg";
-
-const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
-
-// #7878 — the CHECK as it stands now: the latest migration that re-adds it.
-const GRANTS_MIGRATION = join(
-  __dirname,
-  "..",
-  "migrations",
-  "20261011130000_agent_grants_member_pieces_manage",
-  "migration.sql",
-);
-
-describe("the agents_grants_allowed CHECK (#7864 D2, AC-2)", () => {
-  it("names exactly AGENT_GRANTABLE_PERMISSIONS", () => {
-    const sql = readFileSync(GRANTS_MIGRATION, "utf8");
-    const check = /CHECK \("grants" <@ ARRAY\[([^\]]*)\]::TEXT\[\]\)/.exec(sql);
-    expect(check).not.toBeNull();
-    const listed = [...check![1]!.matchAll(/'([^']*)'/g)].map((m) => m[1]);
-    expect(new Set(listed)).toEqual(new Set(AGENT_GRANTABLE_PERMISSIONS));
-    expect(listed).toHaveLength(AGENT_GRANTABLE_PERMISSIONS.length);
-  });
-});
-
-const AGENT_ID = /^agent_[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
-
-describeDb("the agents table (#3591, live DB)", () => {
-  let db: Client;
-  let organizationId: string;
-  let workspaceId: string;
-  let ownerUserId: string;
-  let personUserId: string;
-  let ownerMembershipId: string;
-  let personMembershipId: string;
-  let hashSeq = 0;
-
-  /** A fresh 64-character digest per insert, so the unique key never collides by accident. */
-  function nextHash(): string {
-    hashSeq += 1;
-    return hashSeq.toString(16).padStart(64, "0");
-  }
-
-  async function insertUser(tag: string): Promise<string> {
-    return (
-      await db.query<{ id: string }>(
-        `INSERT INTO "users" ("email", "updated_at") VALUES ($1, now()) RETURNING "id"`,
-        [`agents3591-${tag}@example.test`],
-      )
-    ).rows[0]!.id;
-  }
-
-  async function insertOrganization(slug: string): Promise<string> {
-    return (
-      await db.query<{ id: string }>(
-        `INSERT INTO "organizations" ("name", "slug", "updated_at")
-         VALUES ($1, $1, now()) RETURNING "id"`,
-        [`agents3591-${slug}`],
-      )
-    ).rows[0]!.id;
-  }
-
-  async function insertWorkspace(orgId: string, slug: string): Promise<string> {
-    return (
-      await db.query<{ id: string }>(
-        `INSERT INTO "workspaces" ("organization_id", "name", "slug", "updated_at")
-         VALUES ($1, $2, $2, now()) RETURNING "id"`,
-        [orgId, slug],
-      )
-    ).rows[0]!.id;
-  }
-
-  async function insertMembership(orgId: string, userId: string, role: string): Promise<string> {
-    return (
-      await db.query<{ id: string }>(
-        `INSERT INTO "memberships" ("organization_id", "user_id", "role")
-         VALUES ($1, $2, $3::"Role") RETURNING "id"`,
-        [orgId, userId, role],
-      )
-    ).rows[0]!.id;
-  }
-
-  type AgentColumns = {
-    id?: string;
-    organization_id: string;
-    workspace_id: string;
-    responsible_membership_id: string;
-    created_by_user_id: string;
-    key_issued_to_membership_id: string | null;
-    credential_hash: string;
-  };
-
-  function defaults(): AgentColumns {
-    return {
-      organization_id: organizationId,
-      workspace_id: workspaceId,
-      responsible_membership_id: personMembershipId,
-      created_by_user_id: ownerUserId,
-      key_issued_to_membership_id: ownerMembershipId,
-      credential_hash: nextHash(),
-    };
-  }
-
-  /** Insert one agent; the database mints its id unless one is given. */
-  async function insertAgent(overrides: Partial<AgentColumns> = {}): Promise<string> {
-    const row = { ...defaults(), ...overrides };
-    const columns = Object.keys(row);
-    const values = Object.values(row);
-    const { rows } = await db.query<{ id: string }>(
-      `INSERT INTO "agents" (${columns.map((c) => `"${c}"`).join(", ")}, "name", "credential_prefix", "updated_at")
-       VALUES (${columns.map((_, i) => `$${i + 1}`).join(", ")}, 'inbox helper', 'ailk_agt_abcdefgh', now())
-       RETURNING "id"`,
-      values,
-    );
-    return rows[0]!.id;
-  }
-
-  async function agentRow(id: string): Promise<{ key_issued_to_membership_id: string | null } | undefined> {
-    return (
-      await db.query<{ key_issued_to_membership_id: string | null }>(
-        `SELECT "key_issued_to_membership_id" FROM "agents" WHERE "id" = $1`,
-        [id],
-      )
-    ).rows[0];
-  }
-
-  beforeAll(async () => {
-    db = new Client({ connectionString: process.env.DATABASE_URL });
-    await db.connect();
-    organizationId = await insertOrganization("org");
-    workspaceId = await insertWorkspace(organizationId, "agents3591-ws");
-    ownerUserId = await insertUser("owner");
-    personUserId = await insertUser("person");
-    ownerMembershipId = await insertMembership(organizationId, ownerUserId, "owner");
-    personMembershipId = await insertMembership(organizationId, personUserId, "member");
-  });
-
-  afterAll(async () => {
-    await db.query(`DELETE FROM "organizations" WHERE "slug" LIKE 'agents3591-%'`);
-    await db.query(`DELETE FROM "users" WHERE "email" LIKE 'agents3591-%'`);
-    await db.end();
-  });
-
-  describe("format CHECKs (ADR-0031)", () => {
-    it("an agent takes a database-minted agent_ id, a member ceiling and is enabled", async () => {
-      const id = await insertAgent();
-      expect(id).toMatch(AGENT_ID);
-      const { rows } = await db.query<{ permission_level: string; enabled: boolean }>(
-        `SELECT "permission_level", "enabled" FROM "agents" WHERE "id" = $1`,
-        [id],
-      );
-      expect(rows[0]).toEqual({ permission_level: "member", enabled: true });
-    });
-
-    it.each([
-      ["id", "agents_id_format"],
-      ["organization_id", "agents_organization_id_format"],
-      ["workspace_id", "agents_workspace_id_format"],
-      ["responsible_membership_id", "agents_responsible_membership_id_format"],
-      ["key_issued_to_membership_id", "agents_key_issued_to_membership_id_format"],
-      ["created_by_user_id", "agents_created_by_user_id_format"],
-    ] as const)("REJECTS a malformed %s", async (column, constraint) => {
-      // The format CHECK fires before any foreign key.
-      await expect(insertAgent({ [column]: "bad" })).rejects.toThrow(new RegExp(constraint));
-    });
-
-    it("refuses a ceiling outside the enum", async () => {
-      const id = await insertAgent();
-      await expect(
-        db.query(`UPDATE "agents" SET "permission_level" = 'owner' WHERE "id" = $1`, [id]),
-      ).rejects.toThrow(/AgentPermissionLevel/);
-    });
-  });
-
-  describe("grants (#7864 D2, AC-2)", () => {
-    async function grantsOf(id: string): Promise<string[]> {
-      return (
-        await db.query<{ grants: string[] }>(
-          `SELECT "grants" FROM "agents" WHERE "id" = $1`,
-          [id],
-        )
-      ).rows[0]!.grants;
-    }
-
-    it("a new agent has no grants", async () => {
-      expect(await grantsOf(await insertAgent())).toEqual([]);
-    });
-
-    it("takes grantable permissions", async () => {
-      const id = await insertAgent();
-      await db.query(
-        `UPDATE "agents" SET "grants" = ARRAY['content-edit','magnets-manage']::TEXT[] WHERE "id" = $1`,
-        [id],
-      );
-      expect(await grantsOf(id)).toEqual(["content-edit", "magnets-manage"]);
-    });
-
-    it("takes people-read (#852 D9)", async () => {
-      const id = await insertAgent();
-      await db.query(
-        `UPDATE "agents" SET "grants" = ARRAY['people-read']::TEXT[] WHERE "id" = $1`,
-        [id],
-      );
-      expect(await grantsOf(id)).toEqual(["people-read"]);
-    });
-
-    it("takes member-pieces-manage (#7878)", async () => {
-      const id = await insertAgent();
-      await db.query(
-        `UPDATE "agents" SET "grants" = ARRAY['member-pieces-manage','people-read']::TEXT[] WHERE "id" = $1`,
-        [id],
-      );
-      expect(await grantsOf(id)).toEqual(["member-pieces-manage", "people-read"]);
-    });
-
-    it("refuses any other permission", async () => {
-      const id = await insertAgent();
-      await expect(
-        db.query(
-          `UPDATE "agents" SET "grants" = ARRAY['content-edit','agents-manage']::TEXT[] WHERE "id" = $1`,
-          [id],
-        ),
-      ).rejects.toThrow(/agents_grants_allowed/);
-      expect(await grantsOf(id)).toEqual([]);
-    });
-  });
-
-  it("a credential digest is unique", async () => {
-    const hash = nextHash();
-    await insertAgent({ credential_hash: hash });
-    await expect(insertAgent({ credential_hash: hash })).rejects.toThrow(
-      /agents_credential_hash_key/,
-    );
-  });
-
-  describe("cascades (D1 — leaving stops the agent)", () => {
-    it("deleting the person's membership deletes their agent, and a re-invite does not revive it", async () => {
-      const user = await insertUser("leaver");
-      const membership = await insertMembership(organizationId, user, "member");
-      const agent = await insertAgent({ responsible_membership_id: membership });
-
-      await db.query(`DELETE FROM "memberships" WHERE "id" = $1`, [membership]);
-      expect(await agentRow(agent)).toBeUndefined();
-
-      const reinvited = await insertMembership(organizationId, user, "member");
-      expect(reinvited).not.toBe(membership);
-      expect(await agentRow(agent)).toBeUndefined();
-    });
-
-    it("deleting the workspace deletes its agents", async () => {
-      const doomed = await insertWorkspace(organizationId, "agents3591-doomed");
-      const agent = await insertAgent({ workspace_id: doomed });
-      await db.query(`DELETE FROM "workspaces" WHERE "id" = $1`, [doomed]);
-      expect(await agentRow(agent)).toBeUndefined();
-    });
-
-    it("deleting the organization deletes its agents", async () => {
-      const org = await insertOrganization("doomed-org");
-      const ws = await insertWorkspace(org, "agents3591-doomed-org-ws");
-      const user = await insertUser("doomed-org-person");
-      const membership = await insertMembership(org, user, "owner");
-      const agent = await insertAgent({
-        organization_id: org,
-        workspace_id: ws,
-        responsible_membership_id: membership,
-        key_issued_to_membership_id: membership,
-      });
-      await db.query(`DELETE FROM "organizations" WHERE "id" = $1`, [org]);
-      expect(await agentRow(agent)).toBeUndefined();
-    });
-
-    it("deleting the key-holder's membership keeps the agent and clears key_issued_to_membership_id", async () => {
-      const admin = await insertUser("departing-admin");
-      const adminMembership = await insertMembership(organizationId, admin, "admin");
-      const agent = await insertAgent({ key_issued_to_membership_id: adminMembership });
-
-      await db.query(`DELETE FROM "memberships" WHERE "id" = $1`, [adminMembership]);
-      expect(await agentRow(agent)).toEqual({ key_issued_to_membership_id: null });
-    });
-
-    it("deleting the creator's user row leaves the agent (created_by_user_id has no relation)", async () => {
-      const creator = await insertUser("creator");
-      const agent = await insertAgent({ created_by_user_id: creator, key_issued_to_membership_id: null });
-      await db.query(`DELETE FROM "users" WHERE "id" = $1`, [creator]);
-      expect(await agentRow(agent)).toEqual({ key_issued_to_membership_id: null });
-    });
-  });
-});

package/templates/database/__tests__/appointment.db.test.ts

@@ -1,106 +0,0 @@
-/**
- * @file appointment.db.test.ts
- *
- * LIVE-DATABASE proof that `Appointment.noShow` correctly targets the
- * `no_show` column (#6162). Requires DATABASE_URL pointing at a Postgres with
- * the migrations applied (`prisma migrate deploy`) — the whole suite SKIPS
- * when DATABASE_URL is unset, keeping the workspace Jest run DB-free (the
- * repo convention — see `prefixed-ids.db.test.ts`; the `apps/api Route Tests
- * (Postgres)` workflow runs this file with a real DB, per its own explicit
- * `pnpm --filter @working-theory/database test` step's precedent).
- *
- * The bug this guards: `Appointment.noShow` carried no `@map("no_show")` —
- * every sibling field on the model does — while the migration that creates
- * the table (`20260918120000_add_appointment`) names the column `no_show`.
- * Prisma's generated client then targets the literal column `noShow`, which
- * does not exist, and every `prisma.appointment.create()` (or any other
- * write/read touching this field) fails at runtime.
- *
- * Spawns `appointment-create-probe.ts` via `tsx` (a real ESM process) rather
- * than importing the generated client directly in this file — the generated
- * client (`generated/client/client.ts`) uses `import.meta.url` and cannot
- * load under this package's CJS `ts-jest` transform (the same constraint
- * `prefixed-ids.db.test.ts` documents; see that file's header for why THAT
- * test uses raw `pg` instead — this one needs the real Prisma runtime
- * specifically to prove the `@map` targets the right column, which a raw-SQL
- * probe cannot exercise since it never goes through Prisma's own column-name
- * resolution).
- *
- * RED, reproduced by hand against this exact fixture before the fix (`git
- * stash` the `@map("no_show")` line, `prisma generate`, re-run):
- *
- *   PrismaClientKnownRequestError: The column `noShow of relation
- *   appointments` does not exist in the current database.
- *
- * GREEN, after `@map("no_show")` is restored: the probe's stdout is the
- * created row, `noShow: true` included, and the process exits 0. Both runs
- * are logged in this PR's Verification section.
- */
-import { spawnSync } from "node:child_process";
-import { existsSync } from "node:fs";
-import { join } from "node:path";
-
-const describeDb = process.env.DATABASE_URL ? describe : describe.skip;
-
-const DATABASE_DIR = join(__dirname, "..");
-const PROBE_SCRIPT = join(__dirname, "fixtures", "appointment-create-probe.ts");
-
-/** Walk up from DATABASE_DIR to find node_modules/.bin/tsx (worktree-safe —
- * mirrors `database/inbox/__tests__/schema.test.ts`'s own tsx-via-pnpm-exec
- * invocation, but resolves the binary directly since this call needs a
- * scoped `env` — including a possibly-overridden DATABASE_URL — that `pnpm
- * exec` would otherwise have to re-derive). */
-function findTsxBin(): string {
-  let dir = DATABASE_DIR;
-  for (let i = 0; i < 5; i++) {
-    const candidate = join(dir, "node_modules", ".bin", "tsx");
-    if (existsSync(candidate)) return candidate;
-    dir = join(dir, "..");
-  }
-  throw new Error(`tsx binary not found searching up from ${DATABASE_DIR}.`);
-}
-
-describeDb(
-  "Appointment.noShow — live DB round trip via prisma.appointment.create() (#6162)",
-  () => {
-    it("creates and reads back an Appointment row, including noShow", () => {
-      const tsxBin = findTsxBin();
-      const result = spawnSync(tsxBin, [PROBE_SCRIPT], {
-        cwd: DATABASE_DIR,
-        encoding: "utf-8",
-        env: process.env,
-      });
-
-      // Asserting on exit status + a successful parse of stdout — rather
-      // than requiring empty stderr — is the full signal: a stray Node/tsx
-      // diagnostic (an experimental-feature banner, a deprecation warning)
-      // on an otherwise-successful run must not fail this test (code review
-      // on #6162). A genuine failure still surfaces loudly: `status` carries
-      // the exit code and `stderr` the probe's own logged message.
-      if (result.status !== 0) {
-        throw new Error(
-          `probe exited ${result.status}: ${result.stderr || "(no stderr)"}`,
-        );
-      }
-
-      const row = JSON.parse(result.stdout) as {
-        siteId: string;
-        workspaceId: string;
-        attendeeEmail: string;
-        status: string;
-        noShow: boolean;
-        noShowEventAt: string | null;
-      };
-      expect(row.siteId).toBe("wksp_00000000-0000-7000-8000-00000000f1f1");
-      // #6374 — the probe row is fenced like every other appointments row:
-      // `workspace_id` is NOT NULL and must EQUAL `site_id`. A probe that
-      // still wrote the pre-fence free-form site id would be rejected by
-      // `appointments_workspace_id_format` before this assertion ran.
-      expect(row.workspaceId).toBe(row.siteId);
-      expect(row.attendeeEmail).toBe("appointment-probe@example.invalid");
-      expect(row.status).toBe("confirmed");
-      expect(row.noShow).toBe(true);
-      expect(row.noShowEventAt).not.toBeNull();
-    });
-  },
-);