create-ailk 0.24.0 → 0.25.1

package/templates/apps/api/src/middleware/__tests__/auth.hub-session-path.test.ts

@@ -1,557 +0,0 @@
-/**
- * @file auth.hub-session-path.test.ts
- *
- * The hub-credential branch of the auth preHandler (#7894, spec
- * docs/specs/7894-the-hub-signs-in-its-spec.md D6; AC-4, AC-5, AC-7).
- *
- * A bearer starting `ailk_hst_` is admitted only beside the SAME spoke's key,
- * only while its grant is live and its person verified, and only on the 20
- * routes of `HUB_SESSION_ROUTES` (#8220 D1, AC-1). Any other route answers 404
- * with no handler run (the status `lib/account-config.ts`'s `read()` already
- * loads as "nothing for this caller"), never 403. Each (person, spoke) is
- * limited to 60 requests and 10 writes a minute and 30 writes an hour,
- * charged only after admission (#8220 D2, AC-7).
- *
- * Recording stubs stand in for every admitted and every off-list route; each
- * one records that its handler ran, so "404 with no handler run" is asserted,
- * not assumed.
- *
- * External dependency boundary mocked:
- *   - @working-theory/database (via the prisma singleton; __mocks__/prisma.ts)
- */
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../../lib/prisma.js");
-
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-import {
-  installHubSignInFakeDb,
-  seedSpoke,
-  seedUser,
-  type FakeHubDb,
-  type FakeUser,
-  type SeededSpoke,
-} from "../../__tests__/support/hub-sign-in-fake-db.js";
-import { mintCredential, sha256Hex } from "../../lib/hub-sign-in-store.js";
-import { prisma } from "../../lib/prisma.js";
-import {
-  __resetHubSessionRateBuckets,
-  authPreHandlerPlugin,
-  HUB_SESSION_ROUTES,
-} from "../auth.js";
-
-const db = jest.mocked(prisma);
-
-const FRONTEND = "https://app.example.com";
-
-let state: FakeHubDb;
-let app: FastifyInstance;
-let user: FakeUser;
-let spokeA: SeededSpoke;
-let spokeB: SeededSpoke;
-let handlerRuns: string[];
-
-/**
- * D1's 18 strings plus #8435's two contact routes, #8438's two consents
- * routes, #8765's account-agreements pair and #8515's onboarding pair (26),
- * in the list's order.
- */
-const ADMITTED = [
-  "GET /v1/hub-sign-in/me",
-  "GET /v1/member/pieces",
-  "GET /v1/member/messages",
-  "GET /v1/member/messages/:id/file",
-  "GET /v1/member/purchases",
-  "GET /v1/member/appointments",
-  "GET /v1/member/artifacts",
-  "GET /v1/member/artifacts/:pieceId/versions/:version/file",
-  "GET /v1/member/meeting-types",
-  "GET /v1/member/availability",
-  "GET /v1/member/request-form",
-  "GET /v1/member/billing",
-  "POST /v1/member/artifacts/:pieceId/review",
-  "POST /v1/member/bookings",
-  "POST /v1/member/requests",
-  "POST /v1/member/messages",
-  "PATCH /v1/member/profile",
-  "GET /v1/member/profile/contact",
-  "PATCH /v1/member/profile/contact",
-  "POST /v1/member/deletion-request",
-  "GET /v1/member/consents",
-  "POST /v1/member/consents",
-  // #8765 D5 — the caller's account-level sign-up agreements.
-  "GET /v1/consent/account",
-  "POST /v1/consent/account",
-  // #8515 D13 — the client's onboarding read and write.
-  "GET /v1/member/onboarding",
-  "POST /v1/member/onboarding",
-];
-
-/** Every route the credential must NOT reach, each a recording stub. */
-const OFF_LIST = [
-  "GET /v1/consent/platform",
-  "POST /v1/consent/platform",
-  // #8765 D2 — the anonymous sign-up evidence is never a credential's route.
-  "GET /v1/consent/sign-up",
-  "GET /v1/member/other",
-  "GET /v1/member/messages/:id",
-  "GET /v1/waitlist-signups/me",
-  "GET /v1/flow-checkouts/me",
-  "GET /v1/subscription/me",
-  "POST /v1/subscription/portal-session",
-  "GET /v1/auth/tokens",
-  "PATCH /v1/user/profile",
-  "POST /v1/hub-sign-in/codes",
-  // D7's near misses — one method or one segment from an admitted entry.
-  "GET /v1/member/requests",
-  "GET /v1/member/profile",
-  "POST /v1/member/purchases",
-  "DELETE /v1/member/profile",
-  "GET /v1/member/artifacts/:pieceId",
-  "PUT /v1/member/messages",
-];
-
-/** A registered URL with each `:param` filled in. */
-const concrete = (url: string) =>
-  url
-    .replace(":pieceId", "piece_1")
-    .replace(":version", "1")
-    .replace(":id", "lead_1");
-
-/** A live credential for (user, spoke), stored the way the token route stores it. */
-function grant(
-  s: SeededSpoke,
-  overrides: {
-    expiresAt?: Date;
-    revokedAt?: Date | null;
-    userId?: string;
-  } = {},
-): string {
-  const credential = mintCredential();
-  state.authorizations.push({
-    id: `oautha_${state.authorizations.length + 1}`,
-    userId: overrides.userId ?? user.id,
-    clientId: s.client.id,
-    scopes: ["account"],
-    accessToken: sha256Hex(credential),
-    expiresAt: overrides.expiresAt ?? new Date(Date.now() + 60 * 60 * 1000),
-    revokedAt: overrides.revokedAt ?? null,
-  });
-  return credential;
-}
-
-const headers = (credential: string, s: SeededSpoke = spokeA) => ({
-  authorization: `Bearer ${credential}`,
-  "x-ailk-spoke-key": s.key,
-});
-
-function buildApp(): FastifyInstance {
-  const server = Fastify();
-  server.register(authPreHandlerPlugin, { trustedOrigins: [FRONTEND] });
-
-  const echo =
-    (name: string) => async (req: import("fastify").FastifyRequest) => {
-      handlerRuns.push(name);
-      return {
-        userId: req.userId ?? null,
-        hubSession: req.hubSession ?? null,
-        sessionTenant: req.sessionTenant ?? null,
-        actor: req.actor ?? null,
-      };
-    };
-
-  for (const route of [...ADMITTED, ...OFF_LIST]) {
-    const [method, url] = route.split(" ") as [string, string];
-    server.route({ method: method as "GET", url, handler: echo(route) });
-  }
-  return server;
-}
-
-beforeEach(async () => {
-  jest.resetAllMocks();
-  state = installHubSignInFakeDb(db);
-  handlerRuns = [];
-  __resetHubSessionRateBuckets();
-  user = seedUser(state);
-  spokeA = seedSpoke(state, "a.example.com");
-  spokeB = seedSpoke(state, "b.example.com");
-  app = buildApp();
-  await app.ready();
-});
-
-afterEach(async () => {
-  await app.close();
-});
-
-describe("HUB_SESSION_ROUTES", () => {
-  it("is exactly the 26 entries, by method and registered URL — never a prefix (AC-1, #8515 AC-6, #8765 AC-6)", () => {
-    expect([...HUB_SESSION_ROUTES]).toEqual(ADMITTED);
-    expect(HUB_SESSION_ROUTES.length).toBe(26);
-    for (const route of HUB_SESSION_ROUTES) {
-      expect({
-        route,
-        open: route.endsWith("/") || route.includes("*"),
-      }).toEqual({
-        route,
-        open: false,
-      });
-    }
-  });
-});
-
-describe("hub credential — admitted routes", () => {
-  it.each(ADMITTED)(
-    "%s is admitted as the credential's person, bound to the spoke",
-    async (route) => {
-      const [method, url] = route.split(" ") as [string, string];
-      const credential = grant(spokeA);
-
-      const res = await app.inject({
-        method: method as "GET",
-        url: concrete(url),
-        headers: headers(credential),
-      });
-
-      expect(res.statusCode).toBe(200);
-      expect(handlerRuns).toEqual([route]);
-      const body = res.json();
-      expect(body.userId).toBe(user.id);
-      expect(body.hubSession).toEqual({
-        spokeId: spokeA.spoke.id,
-        workspaceId: spokeA.spoke.workspaceId,
-      });
-      // Acts as its person; never carries a cookie session's tenant.
-      expect(body.actor).toEqual({ type: "user", userId: user.id });
-      expect(body.sessionTenant).toBeNull();
-    },
-  );
-});
-
-describe("hub credential — every other route is 404 with no handler run (AC-7)", () => {
-  it.each([
-    ["GET", "/v1/consent/sign-up"],
-    ["GET", "/v1/consent/platform"],
-    ["GET", "/v1/member/other"],
-    ["GET", "/v1/member/messages/lead_1"],
-    ["GET", "/v1/waitlist-signups/me"],
-    ["GET", "/v1/flow-checkouts/me"],
-    ["GET", "/v1/subscription/me"],
-    ["POST", "/v1/subscription/portal-session"],
-    ["GET", "/v1/auth/tokens"],
-    ["PATCH", "/v1/user/profile"],
-    ["POST", "/v1/hub-sign-in/codes"],
-  ])("%s %s", async (method, url) => {
-    const credential = grant(spokeA);
-
-    const res = await app.inject({
-      method: method as "GET",
-      url,
-      headers: headers(credential),
-    });
-
-    expect(res.statusCode).toBe(404);
-    expect(res.json()).toEqual({
-      ok: false,
-      error: { code: "not_found", message: "Not found" },
-    });
-    expect(handlerRuns).toEqual([]);
-  });
-
-  it.each(
-    OFF_LIST.slice(-6).map((route) => route.split(" ") as [string, string]),
-  )(
-    "the registered near miss %s %s is still the preHandler's 404 (#8220 D7)",
-    async (method, url) => {
-      const credential = grant(spokeA);
-
-      const res = await app.inject({
-        method: method as "GET",
-        url: concrete(url),
-        headers: headers(credential),
-      });
-
-      expect(res.statusCode).toBe(404);
-      expect(res.json()).toEqual({
-        ok: false,
-        error: { code: "not_found", message: "Not found" },
-      });
-      expect(handlerRuns).toEqual([]);
-    },
-  );
-
-  it("the list is method-exact: HEAD on an admitted URL is not admitted", async () => {
-    const credential = grant(spokeA);
-    const res = await app.inject({
-      method: "HEAD",
-      url: "/v1/hub-sign-in/me",
-      headers: headers(credential),
-    });
-    expect(res.statusCode).toBe(404);
-    expect(handlerRuns).toEqual([]);
-  });
-});
-
-describe("hub credential — refused with 401 before any route check", () => {
-  const me = (h: Record<string, string>) =>
-    app.inject({ method: "GET", url: "/v1/hub-sign-in/me", headers: h });
-
-  it("AC-4: spoke A's credential sent with spoke B's key", async () => {
-    const credential = grant(spokeA);
-    expect((await me(headers(credential, spokeB))).statusCode).toBe(401);
-    expect(handlerRuns).toEqual([]);
-  });
-
-  it("the credential with no spoke key at all", async () => {
-    const credential = grant(spokeA);
-    expect(
-      (await me({ authorization: `Bearer ${credential}` })).statusCode,
-    ).toBe(401);
-  });
-
-  it("an unknown spoke key, and a revoked spoke", async () => {
-    const credential = grant(spokeA);
-    expect(
-      (
-        await me({
-          authorization: `Bearer ${credential}`,
-          "x-ailk-spoke-key": "ailk_spk_nope",
-        })
-      ).statusCode,
-    ).toBe(401);
-    spokeA.spoke.revokedAt = new Date();
-    expect((await me(headers(credential))).statusCode).toBe(401);
-  });
-
-  it("an unknown credential", async () => {
-    expect((await me(headers(mintCredential()))).statusCode).toBe(401);
-  });
-
-  it("a revoked credential", async () => {
-    const credential = grant(spokeA, { revokedAt: new Date() });
-    expect((await me(headers(credential))).statusCode).toBe(401);
-  });
-
-  it("an expired credential", async () => {
-    const credential = grant(spokeA, {
-      expiresAt: new Date(Date.now() - 1_000),
-    });
-    expect((await me(headers(credential))).statusCode).toBe(401);
-  });
-
-  it("a credential whose client was disabled", async () => {
-    const credential = grant(spokeA);
-    spokeA.client.enabled = false;
-    expect((await me(headers(credential))).statusCode).toBe(401);
-  });
-
-  it("AC-5: a credential whose person's email is no longer verified", async () => {
-    const credential = grant(spokeA);
-    user.emailVerified = false;
-    expect((await me(headers(credential))).statusCode).toBe(401);
-    expect(handlerRuns).toEqual([]);
-  });
-
-  it("answers the preHandler's existing 401 body", async () => {
-    const res = await me(headers(mintCredential()));
-    expect(res.json()).toEqual({ error: "unauthorized" });
-  });
-});
-
-describe("hub credential — it is a bearer and nothing else", () => {
-  it("AC-5: sent as the better-auth session cookie it is 401 (no Session row matches)", async () => {
-    const credential = grant(spokeA);
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/hub-sign-in/me",
-      headers: {
-        cookie: `better-auth.session_token=${credential}`,
-        "x-ailk-spoke-key": spokeA.key,
-      },
-    });
-    expect(res.statusCode).toBe(401);
-    expect(handlerRuns).toEqual([]);
-  });
-
-  it("is not looked up as a personal ApiToken, and takes no part in the agent branch", async () => {
-    const credential = grant(spokeA);
-    await app.inject({
-      method: "GET",
-      url: "/v1/hub-sign-in/me",
-      headers: headers(credential),
-    });
-    expect(db.apiToken.findUnique).not.toHaveBeenCalled();
-    expect(db.agent.findUnique).not.toHaveBeenCalled();
-  });
-
-  it("is never logged: a rejected request leaves the credential out of the body", async () => {
-    const credential = grant(spokeA, { revokedAt: new Date() });
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/hub-sign-in/me",
-      headers: headers(credential),
-    });
-    expect(res.body).not.toContain(credential);
-  });
-});
-
-// ─── #8220 D2 — the per-(person, spoke) budget (AC-7) ───────────────────────
-
-describe("hub credential — the per-person budget at each spoke (#8220 D2, AC-7)", () => {
-  const T0 = Date.UTC(2026, 9, 11, 12, 0, 0);
-  let now: number;
-  let clock: jest.SpyInstance<number, []>;
-
-  beforeEach(() => {
-    now = T0;
-    clock = jest.spyOn(Date, "now").mockImplementation(() => now);
-  });
-
-  afterEach(() => {
-    clock.mockRestore();
-  });
-
-  const read = (credential: string, s: SeededSpoke = spokeA) =>
-    app.inject({
-      method: "GET",
-      url: "/v1/member/pieces",
-      headers: headers(credential, s),
-    });
-  const write = (credential: string, s: SeededSpoke = spokeA) =>
-    app.inject({
-      method: "POST",
-      url: "/v1/member/messages",
-      headers: headers(credential, s),
-    });
-
-  async function times(
-    n: number,
-    send: () => ReturnType<typeof read>,
-  ): Promise<number[]> {
-    const statuses: number[] = [];
-    for (let i = 0; i < n; i += 1) statuses.push((await send()).statusCode);
-    return statuses;
-  }
-
-  it("a person's 61st admitted request at one spoke in one minute is 429 with Retry-After and the rate_limited body, no handler run", async () => {
-    const credential = grant(spokeA);
-    expect(new Set(await times(60, () => read(credential)))).toEqual(
-      new Set([200]),
-    );
-    handlerRuns = [];
-    now += 15_000;
-
-    const res = await read(credential);
-
-    expect(res.statusCode).toBe(429);
-    expect(res.headers["retry-after"]).toBe("45");
-    expect(res.json()).toEqual({
-      ok: false,
-      error: { code: "rate_limited", message: "Too many requests" },
-    });
-    expect(handlerRuns).toEqual([]);
-  });
-
-  it("another person at the same spoke, and the same person at another spoke, are admitted in that minute (SEC-8220-4)", async () => {
-    const credential = grant(spokeA);
-    await times(60, () => read(credential));
-    expect((await read(credential)).statusCode).toBe(429);
-
-    const other = seedUser(state);
-    expect((await read(grant(spokeA, { userId: other.id }))).statusCode).toBe(
-      200,
-    );
-    expect((await read(grant(spokeB), spokeB)).statusCode).toBe(200);
-    // The spent bucket opens again when its minute ends.
-    now += 60_000;
-    expect((await read(credential)).statusCode).toBe(200);
-  });
-
-  it("the 11th write in a minute is 429; after it a read is admitted and a 12th write is 429", async () => {
-    const credential = grant(spokeA);
-    expect(new Set(await times(10, () => write(credential)))).toEqual(
-      new Set([200]),
-    );
-
-    const eleventh = await write(credential);
-    expect(eleventh.statusCode).toBe(429);
-    expect(Number(eleventh.headers["retry-after"])).toBeGreaterThanOrEqual(1);
-    expect((await read(credential)).statusCode).toBe(200);
-    expect((await write(credential)).statusCode).toBe(429);
-  });
-
-  it("a refused request is not counted: after 10 admitted and 50 refused writes, a read is admitted", async () => {
-    const credential = grant(spokeA);
-    await times(10, () => write(credential));
-    expect(new Set(await times(50, () => write(credential)))).toEqual(
-      new Set([429]),
-    );
-
-    // A counted refusal would make this the 61st request of the minute.
-    expect((await read(credential)).statusCode).toBe(200);
-  });
-
-  it("writes refused by the minute ceiling do not advance the hourly count; the 31st write in an hour is 429 and a read after it is admitted", async () => {
-    const credential = grant(spokeA, {
-      expiresAt: new Date(T0 + 24 * 3_600_000),
-    });
-    // Minute 0: 10 admitted, 20 refused by the minute ceiling.
-    expect(await times(30, () => write(credential))).toEqual([
-      ...Array<number>(10).fill(200),
-      ...Array<number>(20).fill(429),
-    ]);
-    // Minutes 1 and 2: 10 admitted each — 30 admitted in the hour.
-    now += 60_000;
-    expect(new Set(await times(10, () => write(credential)))).toEqual(
-      new Set([200]),
-    );
-    now += 60_000;
-    expect(new Set(await times(10, () => write(credential)))).toEqual(
-      new Set([200]),
-    );
-
-    // Minute 3: the 31st admitted write would pass the minute's ceiling, but
-    // not the hour's — Retry-After is the hour's end, 57 minutes away.
-    now += 60_000;
-    const thirtyFirst = await write(credential);
-    expect(thirtyFirst.statusCode).toBe(429);
-    expect(thirtyFirst.headers["retry-after"]).toBe(String(57 * 60));
-    expect((await read(credential)).statusCode).toBe(200);
-
-    // The hour ends: writes are admitted again.
-    now = T0 + 60 * 60_000;
-    expect((await write(credential)).statusCode).toBe(200);
-  });
-
-  it("100 off-list or refused-credential requests leave the next admitted request admitted — no bucket before admission", async () => {
-    const credential = grant(spokeA);
-    // 70 off-list requests with the person's own live credential: charged
-    // before the route check, they alone would spend the minute's 60.
-    for (let i = 0; i < 70; i += 1) {
-      const res = await app.inject({
-        method: "GET",
-        url: "/v1/subscription/me",
-        headers: headers(credential),
-      });
-      expect(res.statusCode).toBe(404);
-    }
-    for (let i = 0; i < 30; i += 1) {
-      expect((await read(mintCredential())).statusCode).toBe(401);
-    }
-    expect(handlerRuns).toEqual([]);
-
-    expect((await read(credential)).statusCode).toBe(200);
-  });
-
-  it("GET /v1/hub-sign-in/me is an admitted route and is charged like the rest", async () => {
-    const credential = grant(spokeA);
-    await times(60, () => read(credential));
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/hub-sign-in/me",
-      headers: headers(credential),
-    });
-    expect(res.statusCode).toBe(429);
-  });
-});

package/templates/apps/api/src/middleware/__tests__/auth.neither-present.test.ts

@@ -1,72 +0,0 @@
-/**
- * @file auth.neither-present.test.ts
- *
- * Neither cookie nor bearer → 401 unauthorized (#587).
- *
- * Spec §3 #4: when no auth signal is present at all, the preHandler returns
- * 401 with `{ error: 'unauthorized' }` and never reaches the route handler.
- */
-
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../lib/prisma.js", () => ({
-  prisma: {
-    session: { findUnique: jest.fn() },
-    apiToken: {
-      findUnique: jest.fn(),
-      update: jest.fn().mockResolvedValue(undefined),
-    },
-  },
-}));
-
-import { prisma } from "../../lib/prisma.js";
-import { authPreHandlerPlugin } from "../auth.js";
-
-function buildApp(): FastifyInstance {
-  const app = Fastify();
-  app.register(authPreHandlerPlugin, {
-    trustedOrigins: ["https://app.example.com"],
-  });
-  app.get("/echo", async () => ({ ok: true }));
-  return app;
-}
-
-describe("auth preHandler — neither cookie nor bearer", () => {
-  let app: FastifyInstance;
-
-  beforeEach(() => {
-    jest.clearAllMocks();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it('returns 401 with { error: "unauthorized" } and skips both DB lookups', async () => {
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({ method: "GET", url: "/echo" });
-
-    expect(res.statusCode).toBe(401);
-    expect(JSON.parse(res.body)).toEqual({ error: "unauthorized" });
-    expect(prisma.session.findUnique).not.toHaveBeenCalled();
-    expect(prisma.apiToken.findUnique).not.toHaveBeenCalled();
-  });
-
-  it("returns 401 when a cookie name that is NOT a session cookie is sent alone", async () => {
-    app = buildApp();
-    await app.ready();
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/echo",
-      headers: { cookie: "some_other_cookie=foo" },
-    });
-
-    expect(res.statusCode).toBe(401);
-    expect(prisma.session.findUnique).not.toHaveBeenCalled();
-  });
-});