create-ailk 0.24.0 → 0.25.1

package/templates/apps/api/src/lib/__tests__/require-commerce-claim.test.ts

@@ -1,317 +0,0 @@
-/**
- * Unit tests for the commerce claim gate (D-64, #5796; round 2).
- *
- * Mocks @working-theory/license `checkLicense` and asserts the TRI-STATE
- * contract (security review 2026-09-16, High; operator-disposed round 2):
- *
- *   claimed      — read successfully, features[] carries `commerce`
- *   unclaimed    — read successfully and positively WITHOUT the claim, on a
- *                  deployment that configures no licence at all
- *   undetermined — the read did not establish a "no": it threw, the licence
- *                  is revoked, a licence IS configured yet resolves free
- *                  (expired or otherwise unverifiable), or the licence storage
- *                  file could not be READ at all (#5820)
- *
- * Route behaviour differs by what is at stake, which is why this is not one
- * response: the checkout launcher answers the module-disabled 404 on both
- * non-serving states (a checkout that cannot start loses nothing), while the
- * webhook receiver holds an `undetermined` event with a retryable 503 rather
- * than dropping a charge that already happened.
- *
- * The tier is deliberately varied against the claim: this gate reads
- * `features`, never `tier` (D-64).
- */
-
-const mockCheckLicense = jest.fn();
-
-// Only `checkLicense` is stubbed. `readStoredJwtState()` runs for real against
-// a per-test fixture directory pointed at by `AILK_LICENSE_STORAGE_PATH`
-// (#5820): the absent-vs-unreadable distinction IS the thing under test, and a
-// stub of it would assert only that the stub was called — which is exactly how
-// the previous "the storage read throws" case passed against a throw the
-// package can never produce.
-jest.mock("@working-theory/license", () => ({
-  ...jest.requireActual("@working-theory/license"),
-  checkLicense: (...args: unknown[]) => mockCheckLicense(...args),
-}));
-
-import { promises as fs } from "fs";
-import { tmpdir } from "os";
-import { join } from "path";
-
-import type { FastifyReply, FastifyRequest } from "fastify";
-
-import {
-  resolveCommerceClaim,
-  requireCommerceClaim,
-} from "../require-commerce-claim.js";
-
-interface StubReply {
-  statusCalled: number | null;
-  sendCalled: unknown;
-  status: jest.MockedFunction<(code: number) => StubReply>;
-  send: jest.MockedFunction<(body: unknown) => StubReply>;
-}
-
-function makeReply(): StubReply {
-  const reply: StubReply = {
-    statusCalled: null,
-    sendCalled: undefined,
-    status: jest.fn(),
-    send: jest.fn(),
-  };
-  reply.status.mockImplementation((code: number) => {
-    reply.statusCalled = code;
-    return reply;
-  });
-  reply.send.mockImplementation((body: unknown) => {
-    reply.sendCalled = body;
-    return reply;
-  });
-  return reply;
-}
-
-const logWarn = jest.fn();
-
-// The gate reads exactly one thing off the request — `log.warn`. Cast at one
-// typed boundary, the same shape require-paid-tier.test.ts uses.
-function makeRequest(): FastifyRequest {
-  // @ts-expect-error: a stub carrying only `log.warn`; a full FastifyRequest
-  // cannot be constructed without a live server instance in unit tests.
-  return { log: { warn: logWarn } };
-}
-
-const request = makeRequest();
-
-function asReply(stub: StubReply): FastifyReply {
-  // @ts-expect-error: StubReply satisfies the status+send surface requireCommerceClaim uses;
-  // a full Fastify reply cannot be constructed without a live server instance in unit tests.
-  return stub;
-}
-
-function license(overrides: Record<string, unknown> = {}) {
-  return {
-    tier: "pro",
-    plan: "pro-monthly",
-    features: [],
-    expiresAt: null,
-    revoked: false,
-    ...overrides,
-  };
-}
-
-/** The shape `checkLicense()` returns for expired, invalid AND keyless alike. */
-function freeResult() {
-  return license({ tier: "free", plan: null, features: [], revoked: false });
-}
-
-const ORIGINAL_LICENSE_KEY = process.env["AILK_LICENSE_KEY"];
-
-/** A deployment that configures a licence (env key present). */
-function withLicenceConfigured() {
-  // Presence is the whole test — the gate never parses this value, so it is
-  // deliberately not JWT-shaped (a realistic stub trips the secret scanner's
-  // entropy rule for no benefit).
-  process.env["AILK_LICENSE_KEY"] = "fixture";
-}
-
-/** A keyless deployment — no env key, and no storage file at the fixture path. */
-function withNoLicenceConfigured() {
-  delete process.env["AILK_LICENSE_KEY"];
-}
-
-// ── The storage file, for real ──────────────────────────────────────────────
-//
-// Every test points `AILK_LICENSE_STORAGE_PATH` at a fresh temp path that does
-// not exist, which is the `absent` state. The two cases below create the file
-// the package will actually read.
-
-let storageDir: string;
-let storagePath: string;
-
-/** A deployment licensed purely from the refresh storage file. */
-async function withStoredLicence() {
-  await fs.writeFile(storagePath, "stored.jwt.token", "utf8");
-}
-
-/** A storage file that exists and cannot be read — a directory at its path. */
-async function withUnreadableStorage() {
-  await fs.mkdir(storagePath);
-}
-
-beforeEach(async () => {
-  storageDir = await fs.mkdtemp(join(tmpdir(), "ailk-claim-gate-"));
-  storagePath = join(storageDir, ".ailk-license.jwt");
-  process.env["AILK_LICENSE_STORAGE_PATH"] = storagePath;
-});
-
-afterEach(async () => {
-  delete process.env["AILK_LICENSE_STORAGE_PATH"];
-  await fs.rm(storageDir, { recursive: true, force: true });
-});
-
-afterAll(() => {
-  if (ORIGINAL_LICENSE_KEY === undefined) delete process.env["AILK_LICENSE_KEY"];
-  else process.env["AILK_LICENSE_KEY"] = ORIGINAL_LICENSE_KEY;
-});
-
-describe("requireCommerceClaim (the checkout launcher's preHandler)", () => {
-  beforeEach(() => {
-    mockCheckLicense.mockReset();
-    logWarn.mockReset();
-    withNoLicenceConfigured();
-  });
-
-  it("404s the module-disabled body when features[] lacks 'commerce'", async () => {
-    mockCheckLicense.mockResolvedValue(freeResult());
-    const reply = makeReply();
-
-    await requireCommerceClaim(request, asReply(reply));
-
-    expect(reply.statusCalled).toBe(404);
-    expect(reply.sendCalled).toEqual({
-      error: "not_found",
-      message: "Not found",
-    });
-  });
-
-  it("404s a PAID tier that carries other features but not 'commerce'", async () => {
-    mockCheckLicense.mockResolvedValue(
-      license({ tier: "enterprise", features: ["docs", "multi-tenant"] }),
-    );
-    const reply = makeReply();
-
-    await requireCommerceClaim(request, asReply(reply));
-
-    expect(reply.statusCalled).toBe(404);
-  });
-
-  it("proceeds when features[] includes 'commerce'", async () => {
-    mockCheckLicense.mockResolvedValue(license({ features: ["commerce"] }));
-    const reply = makeReply();
-
-    await requireCommerceClaim(request, asReply(reply));
-
-    expect(reply.statusCalled).toBeNull();
-    expect(reply.send).not.toHaveBeenCalled();
-  });
-
-  // Round 2, D1: the checkout launcher answers the module-disabled response on
-  // BOTH non-serving states. A checkout that cannot be started loses nothing,
-  // so there is no reason to leak a "configured but unreadable" shape here —
-  // it is the webhook, where money has already moved, that holds with a 503.
-  it("404s — not 503s — on an undetermined read, because a checkout that cannot start loses nothing", async () => {
-    mockCheckLicense.mockRejectedValue(new Error("boom"));
-    const reply = makeReply();
-
-    await requireCommerceClaim(request, asReply(reply));
-
-    expect(reply.statusCalled).toBe(404);
-    expect(reply.sendCalled).toEqual({
-      error: "not_found",
-      message: "Not found",
-    });
-  });
-
-  it("404s a revoked license even while the claim is still in the JWT", async () => {
-    mockCheckLicense.mockResolvedValue(
-      license({ features: ["commerce"], revoked: true }),
-    );
-    const reply = makeReply();
-
-    await requireCommerceClaim(request, asReply(reply));
-
-    expect(reply.statusCalled).toBe(404);
-  });
-});
-
-describe("resolveCommerceClaim", () => {
-  beforeEach(() => {
-    mockCheckLicense.mockReset();
-    withNoLicenceConfigured();
-  });
-
-  it("is 'claimed' for a live license carrying the claim", async () => {
-    mockCheckLicense.mockResolvedValue(license({ features: ["commerce"] }));
-    await expect(resolveCommerceClaim()).resolves.toBe("claimed");
-  });
-
-  it("is 'unclaimed' for a license read successfully that lacks the claim", async () => {
-    mockCheckLicense.mockResolvedValue(license({ features: ["docs"] }));
-    await expect(resolveCommerceClaim()).resolves.toBe("unclaimed");
-  });
-
-  it("is 'unclaimed' on a KEYLESS build — no licence configured is a positive 'no'", async () => {
-    mockCheckLicense.mockResolvedValue(freeResult());
-    await expect(resolveCommerceClaim()).resolves.toBe("unclaimed");
-  });
-
-  // The storage-file path. `checkLicense()` resolves a licence from
-  // AILK_LICENSE_KEY *or* the refresh storage file, so a deployment can be
-  // fully licensed with no env key at all. An env-only "is a licence
-  // configured" test read that site as keyless, so its EXPIRED licence
-  // resolved `unclaimed` and its already-charged events were dropped — the
-  // same High the tri-state exists to prevent, one path over.
-  it("is 'undetermined' for an EXPIRED licence held only in the storage file", async () => {
-    delete process.env["AILK_LICENSE_KEY"];
-    mockCheckLicense.mockResolvedValue(freeResult());
-    await withStoredLicence();
-    await expect(resolveCommerceClaim()).resolves.toBe("undetermined");
-  });
-
-  it("is 'unclaimed' when neither the env key nor the storage file has a token", async () => {
-    delete process.env["AILK_LICENSE_KEY"];
-    mockCheckLicense.mockResolvedValue(freeResult());
-    await expect(resolveCommerceClaim()).resolves.toBe("unclaimed");
-  });
-
-  // #5820. Holding is the safe direction: a file that could not be READ is not
-  // evidence that a site is keyless, and dropping a signed Stripe event needs
-  // evidence. The previous version of this case stubbed `readStoredJwt()` into
-  // rejecting — a throw the package never produces, since it catches every
-  // error — so it passed while the real path acked 200 and lost the charge.
-  it("is 'undetermined' when the storage file exists and cannot be READ", async () => {
-    delete process.env["AILK_LICENSE_KEY"];
-    mockCheckLicense.mockResolvedValue(freeResult());
-    await withUnreadableStorage();
-    await expect(resolveCommerceClaim()).resolves.toBe("undetermined");
-  });
-
-  it("is 'undetermined' when the read itself throws", async () => {
-    mockCheckLicense.mockRejectedValue(new Error("boom"));
-    await expect(resolveCommerceClaim()).resolves.toBe("undetermined");
-  });
-
-  // Round 2, D1 (operator-disposed): a revoked licence is a PAYING commerce
-  // deployment inside its JWT window. Dropping its already-charged events is
-  // the same data loss the security review's High named, so it holds.
-  it("is 'undetermined' for a revoked license — a revoked site is still a live one mid-window", async () => {
-    mockCheckLicense.mockResolvedValue(
-      license({ features: ["commerce"], revoked: true }),
-    );
-    await expect(resolveCommerceClaim()).resolves.toBe("undetermined");
-  });
-
-  // Round 2, D1: an EXPIRED licence. `checkLicense()` collapses expired,
-  // invalid and keyless into one identical free result (check-license.ts
-  // returns FREE_RESULT for all three), so the only signal that separates
-  // "this site configured a licence that no longer verifies" from "this site
-  // never had one" is whether a licence is configured at all.
-  it("is 'undetermined' when a licence IS configured yet resolves free — expired or unverifiable", async () => {
-    withLicenceConfigured();
-    mockCheckLicense.mockResolvedValue(freeResult());
-    await expect(resolveCommerceClaim()).resolves.toBe("undetermined");
-  });
-
-  it("is 'claimed' for a configured licence that verifies and carries the claim", async () => {
-    withLicenceConfigured();
-    mockCheckLicense.mockResolvedValue(license({ features: ["commerce"] }));
-    await expect(resolveCommerceClaim()).resolves.toBe("claimed");
-  });
-
-  it("is 'unclaimed' for a configured licence that verifies to a paid tier without the claim", async () => {
-    withLicenceConfigured();
-    mockCheckLicense.mockResolvedValue(license({ features: ["docs"] }));
-    await expect(resolveCommerceClaim()).resolves.toBe("unclaimed");
-  });
-});

package/templates/apps/api/src/lib/__tests__/require-paid-tier.test.ts

@@ -1,129 +0,0 @@
-/**
- * Unit tests for the require-paid-tier Fastify preHandler.
- *
- * Mocks @working-theory/license `checkLicense` and asserts:
- *   - free tier → reply.status(402).send(payment_required canonical body)
- *   - pro tier  → preHandler returns void (handler proceeds)
- *   - checkLicense throws → safe-by-default 402 (no false-positive proceed)
- */
-
-const mockCheckLicense = jest.fn();
-
-jest.mock("@working-theory/license", () => ({
-  checkLicense: (...args: unknown[]) => mockCheckLicense(...args),
-}));
-
-import type { FastifyReply, FastifyRequest } from "fastify";
-
-import { requirePaidTier } from "../require-paid-tier.js";
-
-// ── Typed reply builder ───────────────────────────────────────────────────────
-//
-// A minimal Fastify reply stub that satisfies the FastifyReply interface surface
-// used by requirePaidTier (status + send chain). Using a properly typed factory
-// avoids the `as unknown as FastifyReply` double assertion pattern.
-
-interface StubReply {
-  statusCalled: number | null;
-  sendCalled: unknown;
-  status: jest.MockedFunction<(code: number) => StubReply>;
-  send: jest.MockedFunction<(body: unknown) => StubReply>;
-}
-
-function makeReply(): StubReply {
-  const reply: StubReply = {
-    statusCalled: null,
-    sendCalled: undefined,
-    status: jest.fn(),
-    send: jest.fn(),
-  };
-  reply.status.mockImplementation((code: number) => {
-    reply.statusCalled = code;
-    return reply;
-  });
-  reply.send.mockImplementation((body: unknown) => {
-    reply.sendCalled = body;
-    return reply;
-  });
-  return reply;
-}
-
-// Cast the stub to FastifyReply once, at a typed boundary, so all call-sites
-// use the actual StubReply type rather than repeating the double assertion.
-function asReply(stub: StubReply): FastifyReply {
-  // @ts-expect-error: StubReply satisfies the status+send surface used by requirePaidTier;
-  // a full Fastify reply cannot be constructed without a live server instance in unit tests.
-  return stub;
-}
-
-const fakeRequest = {} as FastifyRequest;
-
-describe("requirePaidTier", () => {
-  beforeEach(() => {
-    mockCheckLicense.mockReset();
-  });
-
-  it("free tier — replies 402 with canonical payment_required body", async () => {
-    mockCheckLicense.mockResolvedValue({
-      tier: "free",
-      plan: null,
-      features: [],
-      expiresAt: null,
-      revoked: false,
-    });
-    const reply = makeReply();
-
-    await requirePaidTier(fakeRequest, asReply(reply));
-
-    expect(reply.statusCalled).toBe(402);
-    expect(reply.sendCalled).toEqual({
-      error: "payment_required",
-      message: expect.stringContaining("paid license"),
-    });
-  });
-
-  it("pro tier — proceeds without calling reply.status/send", async () => {
-    mockCheckLicense.mockResolvedValue({
-      tier: "pro",
-      plan: "pro",
-      features: [],
-      expiresAt: null,
-      revoked: false,
-    });
-    const reply = makeReply();
-
-    await requirePaidTier(fakeRequest, asReply(reply));
-
-    expect(reply.status).not.toHaveBeenCalled();
-    expect(reply.send).not.toHaveBeenCalled();
-  });
-
-  it("checkLicense throws — degrades to 402 (safe default)", async () => {
-    mockCheckLicense.mockRejectedValue(new Error("boom"));
-    const reply = makeReply();
-
-    await requirePaidTier(fakeRequest, asReply(reply));
-
-    expect(reply.statusCalled).toBe(402);
-    expect(reply.sendCalled).toMatchObject({ error: "payment_required" });
-  });
-
-  it("revoked paid license — replies 402 even though tier is pro (issue #398)", async () => {
-    // After a 403/revoked refresh, checkLicense() returns tier:'pro' until
-    // the existing JWT exp (up to 24h). The revoked flag is the early
-    // signal — we must close the gate now, not wait for exp.
-    mockCheckLicense.mockResolvedValue({
-      tier: "pro",
-      plan: "pro",
-      features: [],
-      expiresAt: null,
-      revoked: true,
-    });
-    const reply = makeReply();
-
-    await requirePaidTier(fakeRequest, asReply(reply));
-
-    expect(reply.statusCalled).toBe(402);
-    expect(reply.sendCalled).toMatchObject({ error: "payment_required" });
-  });
-});