create-ailk 0.24.0 → 0.25.1

package/templates/apps/api/src/routes/project-listings/__tests__/founder-identity.test.ts

@@ -1,847 +0,0 @@
-/**
- * @file founder-identity.test.ts
- *
- * THE ACCEPTANCE GATE for the founder's identity in parts and the resume
- * link's email verification (#5407).
- *
- * Two properties carry this change, and both look fine when broken:
- *
- *   1. `founder_name` STILL HOLDS A DISPLAY NAME, composed server-side from
- *      the parts wherever they are written. Every existing reader of it — the
- *      submit-time slug fallback, the approve/reject email's greeting, the
- *      Slack review card, the build issue, the `routeLead` identity — reads
- *      that column and nothing else, so a `start` that stored the parts and
- *      left the display line to the client would break all of them at once,
- *      silently, one release later. The stored line and the stored parts must
- *      also never DISAGREE, which is why the parts win over a `founderName`
- *      sent beside them.
- *
- *   2. VERIFICATION IS WRITE-ONCE AND TOKEN-GATED. The stamp says the resume
- *      token reached `founder_email` and came back; a second opening must not
- *      move it, and a wrong token must change nothing and be indistinguishable
- *      from an unknown draft. An anonymous route whose entire input is an id
- *      and a token is an oracle for which drafts exist the moment its answers
- *      differ.
- *
- * Same harness as `structured-address.test.ts`: real routes, real services,
- * mocked `lib/prisma.js` over a small in-memory row store, `routeLead`
- * running for real against a per-test temp path.
- */
-
-// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock
-jest.mock("../../../lib/prisma.js");
-
-jest.mock("@working-theory/email", () => ({
-  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
-  // #5406/#5407 — the resume email is the ONLY carrier of the verification
-  // nonce, so this mock is not a stub to keep the suite quiet: it is the
-  // founder's mailbox. `nonceFromEmail` below reads the nonce back out of the
-  // link this was asked to send, which is the only way any test here can
-  // obtain one.
-  sendListingResumeEmail: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-resume" }),
-}));
-
-jest.mock("@working-theory/license", () => ({
-  checkLicense: jest.fn().mockResolvedValue({
-    tier: "free",
-    plan: null,
-    features: [],
-    expiresAt: null,
-    revoked: false,
-  }),
-}));
-
-import { sendListingResumeEmail } from "@working-theory/email";
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
-import {
-  mockNoWorkspace,
-  mockWorkspaceExists,
-} from "../../../lib/__mocks__/prisma.js";
-import { prisma } from "../../../lib/prisma.js";
-import { patchProjectListingDraftRoute } from "../patch-draft.js";
-import { startProjectListingRoute } from "../start.js";
-import { submitProjectListingRoute } from "../submit.js";
-import { verifyProjectListingDraftEmailRoute } from "../verify-email.js";
-
-// ─── Fixtures ───────────────────────────────────────────────────────────────
-
-const SITE_ID = "site-1";
-const SITE_KEY = "pk-site-1";
-
-const opt = (value: string, label: string) => ({ value, label });
-
-const VALID_QUESTIONS = {
-  q2: {
-    prompt: "Why are you here?",
-    options: [opt("scale", "Scaling my team"), opt("just-curious", "Just curious")],
-  },
-  q3: { prompt: "Stage?", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
-  q4: { prompt: "Team size?", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
-  q5: {
-    prompt: "Urgency?",
-    options: [opt("urgent", "Now"), opt("planning", "Soon"), opt("exploring", "Someday")],
-  },
-  q6: {
-    prompt: "Pain?",
-    options: [
-      opt("low", "Low"),
-      opt("medium", "Medium"),
-      opt("high", "High"),
-      opt("critical", "Critical"),
-    ],
-  },
-  q7: { prompt: "Anything else?" },
-  extras: [],
-};
-
-/** The #5407 contact screen's body: the name in PARTS, plus a phone. */
-const START_PAYLOAD = {
-  siteKey: SITE_KEY,
-  founderFirstName: "Ada",
-  founderLastName: "Lovelace",
-  founderEmail: "ada@example.com",
-  founderPhone: "+44 20 7946 0958",
-  consent: true,
-};
-
-/** What every caller that predates #5407 sends, and must go on sending. */
-const LEGACY_START_PAYLOAD = {
-  siteKey: SITE_KEY,
-  founderName: "Ada van der Berg",
-  founderEmail: "ada@example.com",
-  consent: true,
-};
-
-/** Everything the steps after step one collect, minus the address. */
-const APPLICATION_WITHOUT_ADDRESS = {
-  name: "My Project",
-  headline: "Ten words or fewer for the tile title here",
-  oneLiner: "A short sentence describing what the project does for its people.",
-  problem: "The problem is real and this describes it.",
-  product: "wireframes",
-  commitment: "part-time",
-  teamComposition: "co-founders",
-  faqs: [
-    { question: "Q one?", answer: "A one." },
-    { question: "Q two?", answer: "A two." },
-    { question: "Q three?", answer: "A three." },
-  ],
-  questions: VALID_QUESTIONS,
-};
-
-/** A complete address, so a draft can be driven all the way to `submit`. */
-const ADDRESS_PARTS = {
-  addressLine1: "221B Baker Street",
-  city: "London",
-  region: "Greater London",
-  postalCode: "NW1 6XE",
-  country: "GB",
-};
-
-// ─── The in-memory row store the Prisma mock is backed by ───────────────────
-
-type Row = Record<string, unknown>;
-
-let rows: Row[];
-let nextId: number;
-/** Whether the site has switched the #5406 resume email on for this test. */
-let resumeEmailEnabled = true;
-
-/**
- * The site's `SiteListingConfig` row, carrying the two members #5406 requires
- * before it will send anything. Everything else falls back to the platform
- * defaults, exactly as it does for a site that configures only these.
- */
-const SITE_CONFIG_ROW = {
-  // `listingConfigFor` selects `data` and parses that blob — the config is one
-  // JSON column, not a row of columns.
-  data: {
-    resumeEmail: {
-      fromAddress: "hello@site.example",
-      baseUrl: "https://site.example/apply",
-    },
-  },
-};
-
-function matches(row: Row, where: Record<string, unknown>): boolean {
-  return Object.entries(where).every(([key, value]) => {
-    if (key === "OR") {
-      return (value as Record<string, unknown>[]).some((clause) => matches(row, clause));
-    }
-    if (value !== null && typeof value === "object" && !(value instanceof Date)) {
-      const clause = value as Record<string, unknown>;
-      if ("in" in clause) return (clause["in"] as unknown[]).includes(row[key]);
-      if ("not" in clause) return row[key] !== clause["not"];
-      if ("gt" in clause) return (row[key] as Date) > (clause["gt"] as Date);
-      if ("startsWith" in clause) {
-        return (
-          typeof row[key] === "string" &&
-          (row[key] as string).startsWith(clause["startsWith"] as string)
-        );
-      }
-    }
-    return row[key] === value;
-  });
-}
-
-function installStore(): void {
-  // #6335 — the shared prisma mock no longer resolves ANY requested
-  // workspace id. `startProjectListingDraft` stamps the row's `workspaceId`
-  // by resolving the site it was filed against (`resolveWorkspaceIdForSite`,
-  // services/project-listings.ts), so this suite states the ONE site it is
-  // built around. Keyed on the requested id — nothing else resolves.
-  mockWorkspaceExists(prisma, SITE_ID);
-
-  rows = [];
-  nextId = 1;
-  resumeEmailEnabled = true;
-
-  (prisma.lead.create as jest.Mock).mockImplementation(() =>
-    Promise.resolve({ id: `lead_00000000-0000-7000-8000-00000000000${nextId}` }),
-  );
-
-  (prisma.siteListingConfig.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { siteId?: string; publicKey?: string } }) => {
-      if (where.publicKey !== undefined) {
-        return Promise.resolve(where.publicKey === SITE_KEY ? { siteId: SITE_ID } : null);
-      }
-      // #5406 — the resume email is OPT-IN, and this suite opts in: without
-      // `fromAddress` and `baseUrl` no message is sent, so no nonce is ever
-      // delivered and nothing here could verify. The `resume-email-off` block
-      // at the end of the file asserts exactly that state, with this returning
-      // null instead.
-      return Promise.resolve(resumeEmailEnabled ? SITE_CONFIG_ROW : null);
-    },
-  );
-
-  // #5275 — the grant write `start` makes after the row. Append-only; it only
-  // needs to resolve here (drafts.test.ts asserts on what it is called with).
-  (prisma.consentGrant.createMany as jest.Mock).mockImplementation(
-    ({ data }: { data: Row[] }) => Promise.resolve({ count: data.length }),
-  );
-
-  // #5275 — `start` writes the row and its grant in one interactive
-  // transaction; the mock hands the same store-backed client through.
-  (prisma.$transaction as jest.Mock).mockImplementation(
-    async (fn: (tx: typeof prisma) => Promise<unknown>) => fn(prisma),
-  );
-
-  (prisma.projectListing.create as jest.Mock).mockImplementation(({ data }: { data: Row }) => {
-    const now = new Date();
-    const row: Row = {
-      id: `prjl_00000000-0000-7000-8000-00000000000${nextId++}`,
-      slug: null,
-      name: null,
-      oneLiner: null,
-      problem: null,
-      url: null,
-      product: null,
-      commitment: null,
-      teamComposition: null,
-      faqs: null,
-      anythingElse: null,
-      address: null,
-      // #5279 — a freshly-started draft has no parts, exactly like every row
-      // written before the columns existed.
-      addressLine1: null,
-      addressLine2: null,
-      addressCity: null,
-      addressRegion: null,
-      addressPostalCode: null,
-      addressCountry: null,
-      questions: null,
-      // #5407 — a row written before the columns existed, and a freshly
-      // started draft on a site that asks for one name line: parts null,
-      // no phone, no verification stamp.
-      founderFirstName: null,
-      founderLastName: null,
-      founderPhone: null,
-      emailVerifiedAt: null,
-      founderCompany: null,
-      leadId: null,
-      headline: null,
-      logoMarkUrl: null,
-      logoWordmarkUrl: null,
-      solution: null,
-      featured: false,
-      decidedAt: null,
-      decidedBy: null,
-      issueUrl: null,
-      experimentKey: null,
-      windowEndsAt: null,
-      createdAt: now,
-      updatedAt: now,
-      ...data,
-    };
-    rows.push(row);
-    return Promise.resolve(row);
-  });
-
-  (prisma.projectListing.findFirst as jest.Mock).mockImplementation(
-    ({ where }: { where: Record<string, unknown> }) =>
-      Promise.resolve(rows.find((row) => matches(row, where)) ?? null),
-  );
-
-  (prisma.projectListing.findMany as jest.Mock).mockImplementation(
-    ({ where }: { where: Record<string, unknown> }) =>
-      Promise.resolve(rows.filter((row) => matches(row, where))),
-  );
-
-  (prisma.projectListing.update as jest.Mock).mockImplementation(
-    ({ where, data }: { where: Record<string, unknown>; data: Row }) => {
-      const row = rows.find((r) => matches(r, where));
-      Object.assign(row!, data, { updatedAt: new Date() });
-      return Promise.resolve(row);
-    },
-  );
-
-  (prisma.projectListing.updateMany as jest.Mock).mockImplementation(
-    ({ where, data }: { where: Record<string, unknown>; data: Row }) => {
-      const matched = rows.filter((r) => matches(r, where));
-      matched.forEach((r) => Object.assign(r, data, { updatedAt: new Date() }));
-      return Promise.resolve({ count: matched.length });
-    },
-  );
-}
-
-// ─── Helpers ────────────────────────────────────────────────────────────────
-
-const bearer = (token: string) => ({ authorization: `Bearer ${token}` });
-
-async function buildApp(): Promise<FastifyInstance> {
-  const app = Fastify();
-  await app.register(startProjectListingRoute);
-  await app.register(patchProjectListingDraftRoute);
-  await app.register(submitProjectListingRoute);
-  await app.register(verifyProjectListingDraftEmailRoute);
-  await app.ready();
-  return app;
-}
-
-async function startDraft(
-  app: FastifyInstance,
-  payload: Record<string, unknown> = START_PAYLOAD,
-): Promise<{ id: string; resumeToken: string }> {
-  const res = await app.inject({
-    method: "POST",
-    url: "/v1/project-listings",
-    payload,
-  });
-  expect(res.statusCode).toBe(201);
-  return (res.json() as { data: { id: string; resumeToken: string } }).data;
-}
-
-/**
- * Call the verify route the way a founder's browser does when it lands on the
- * emailed link: the resume token in the header, the nonce in the body.
- *
- * `nonce` is deliberately a separate argument rather than something derived
- * from `draft`, because the WHOLE POINT of #5407's fix is that the nonce is
- * not derivable from anything `start` hands back. A test that could reach it
- * without going through the email would be testing the forgeable design.
- */
-const verifyEmail = (
-  app: FastifyInstance,
-  id: string,
-  token?: string,
-  nonce?: string,
-) =>
-  app.inject({
-    method: "POST",
-    url: `/v1/project-listings/drafts/${id}/verify-email`,
-    ...(token === undefined ? {} : { headers: bearer(token) }),
-    ...(nonce === undefined ? {} : { payload: { verifyNonce: nonce } }),
-  });
-
-/**
- * Wait for the fire-and-forget resume email to have been dispatched.
- *
- * `start` returns its 201 without awaiting the send, so the mock is called a
- * microtask or two later. Polling the mock is what makes every test below
- * deterministic without reaching into the service's internals.
- */
-async function waitForEmail(listingId: string): Promise<void> {
-  for (let i = 0; i < 50; i += 1) {
-    const sent = (sendListingResumeEmail as jest.Mock).mock.calls.some(([arg]) =>
-      String((arg as { resumeLink: string }).resumeLink).includes(listingId),
-    );
-    if (sent) return;
-    await new Promise((resolve) => setTimeout(resolve, 2));
-  }
-  throw new Error(`no resume email dispatched for ${listingId}`);
-}
-
-/**
- * The nonce as it reached the FOUNDER — read out of the link the resume email
- * was asked to send, which is the only place it exists outside the server.
- *
- * `sendListingResumeEmail` is mocked at the top of this file, so this reads
- * the argument `project-listing-resume-email.ts` passed it. That indirection
- * is the test's whole value: it proves the nonce travels by mail and by
- * nothing else.
- */
-function nonceFromEmail(listingId: string): string {
-  const calls = (sendListingResumeEmail as jest.Mock).mock.calls;
-  const call = calls.find(([arg]) =>
-    String((arg as { resumeLink: string }).resumeLink).includes(listingId),
-  );
-  if (!call) throw new Error(`no resume email sent for ${listingId}`);
-  const link = new URL((call[0] as { resumeLink: string }).resumeLink);
-  const nonce = link.searchParams.get("verify");
-  if (!nonce) throw new Error("the emailed link carried no verify nonce");
-  return nonce;
-}
-
-const patch = (
-  app: FastifyInstance,
-  draft: { id: string; resumeToken: string },
-  payload: Record<string, unknown>,
-) =>
-  app.inject({
-    method: "PATCH",
-    url: `/v1/project-listings/drafts/${draft.id}`,
-    headers: bearer(draft.resumeToken),
-    payload,
-  });
-
-const submit = (app: FastifyInstance, draft: { id: string; resumeToken: string }) =>
-  app.inject({
-    method: "POST",
-    url: `/v1/project-listings/drafts/${draft.id}/submit`,
-    headers: bearer(draft.resumeToken),
-  });
-
-const storedRow = (id: string): Row => {
-  const row = rows.find((r) => r["id"] === id);
-  expect(row).toBeDefined();
-  return row!;
-};
-
-const draftBody = (res: { json: () => unknown }) =>
-  (res.json() as { data: Record<string, unknown> }).data;
-
-// ─── Tests ──────────────────────────────────────────────────────────────────
-
-describe("the founder's identity in parts (#5407)", () => {
-  setupLeadFileEnv("project-listing-founder-identity");
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    installStore();
-    app = await buildApp();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  describe("`start` stores the parts AND composes the display name", () => {
-    it("writes first name, last name and phone to their own columns", async () => {
-      const draft = await startDraft(app);
-
-      const row = storedRow(draft.id);
-      expect(row["founderFirstName"]).toBe("Ada");
-      expect(row["founderLastName"]).toBe("Lovelace");
-      expect(row["founderPhone"]).toBe("+44 20 7946 0958");
-    });
-
-    it("writes `founder_name` as the composed display string", async () => {
-      // The column every existing reader reads. Written out literally rather
-      // than by calling `composeFounderName`, so a change to the joiner fails
-      // this test instead of travelling through it.
-      const draft = await startDraft(app);
-      expect(storedRow(draft.id)["founderName"]).toBe("Ada Lovelace");
-    });
-
-    it("composes from the PARTS even when the body also sends a display line", async () => {
-      // The stored line and the stored parts must never disagree — a row
-      // saying "A. Lovelace" beside parts saying "Ada" + "Lovelace" has no
-      // reader that can tell which is right.
-      const draft = await startDraft(app, {
-        ...START_PAYLOAD,
-        founderName: "A. Lovelace",
-      });
-
-      const row = storedRow(draft.id);
-      expect(row["founderName"]).toBe("Ada Lovelace");
-      expect(row["founderFirstName"]).toBe("Ada");
-      expect(row["founderLastName"]).toBe("Lovelace");
-    });
-
-    it("carries the composed name through SUBMIT, which is where every reader picks it up", async () => {
-      // `submit` is the moment the slug is derived, the Lead is written and
-      // the Slack card is posted — all three read `founderName` off the row
-      // and none of them knows the parts exist.
-      const draft = await startDraft(app);
-      await patch(app, draft, { ...APPLICATION_WITHOUT_ADDRESS, address: ADDRESS_PARTS });
-
-      const res = await submit(app, draft);
-
-      expect(res.statusCode).toBe(200);
-      expect(storedRow(draft.id)["founderName"]).toBe("Ada Lovelace");
-      // The parts survive the transition beside it, unaltered.
-      expect(storedRow(draft.id)["founderFirstName"]).toBe("Ada");
-      expect(storedRow(draft.id)["founderLastName"]).toBe("Lovelace");
-    });
-  });
-
-  describe("a caller that predates #5407 is untouched", () => {
-    it("stores a `founderName` line VERBATIM, with both parts null", async () => {
-      const draft = await startDraft(app, LEGACY_START_PAYLOAD);
-
-      const row = storedRow(draft.id);
-      // Nothing splits it. "Ada van der Berg" has no last space that means
-      // anything, and a wrong split would put an invented surname on the row
-      // the operator reviews with nothing to mark it as invented.
-      expect(row["founderName"]).toBe("Ada van der Berg");
-      expect(row["founderFirstName"]).toBeNull();
-      expect(row["founderLastName"]).toBeNull();
-      expect(row["founderPhone"]).toBeNull();
-    });
-
-    it("refuses a body carrying no name at all, rather than writing a blank one", async () => {
-      const { founderName: _line, ...nameless } = LEGACY_START_PAYLOAD;
-
-      const res = await app.inject({
-        method: "POST",
-        url: "/v1/project-listings",
-        payload: nameless,
-      });
-
-      expect(res.statusCode).toBe(400);
-      expect(rows).toHaveLength(0);
-    });
-
-    it("refuses whitespace-only parts, rather than storing a blank-looking name", async () => {
-      const res = await app.inject({
-        method: "POST",
-        url: "/v1/project-listings",
-        payload: { ...START_PAYLOAD, founderFirstName: "   ", founderLastName: "  " },
-      });
-
-      expect(res.statusCode).toBe(400);
-      expect(rows).toHaveLength(0);
-    });
-  });
-
-  describe("the founder's own draft read echoes their own input back", () => {
-    it("carries the phone and an unverified stamp", async () => {
-      // The founder's own echo DOES carry the phone — it is their own step-one
-      // input, returned to the person who typed it. What must never carry it
-      // is the PUBLIC read, which `public.test.ts` asserts against a row with
-      // a real phone on it rather than a null one.
-      const draft = await startDraft(app);
-      const body = draftBody(await patch(app, draft, { headline: "A headline here" }));
-      expect(body["founderPhone"]).toBe("+44 20 7946 0958");
-      expect(body["emailVerifiedAt"]).toBeNull();
-    });
-  });
-});
-
-describe("the resume link's email verification (#5407)", () => {
-  setupLeadFileEnv("project-listing-verify-email");
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    installStore();
-    app = await buildApp();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  /** Start a draft and wait for its resume email to have been dispatched. */
-  async function startAndMail(): Promise<{
-    id: string;
-    resumeToken: string;
-    nonce: string;
-  }> {
-    const draft = await startDraft(app);
-    // The send is fire-and-forget, so it lands a microtask or two after the
-    // 201. Waiting on the mock is what makes this deterministic.
-    await waitForEmail(draft.id);
-    return { ...draft, nonce: nonceFromEmail(draft.id) };
-  }
-
-  // ── THE LOAD-BEARING TEST ────────────────────────────────────────────────
-  //
-  // The first design of this route stamped on the resume token alone, and the
-  // resume token is in `start`'s own 201 body. So the forge was two calls:
-  // open a draft under a stranger's address, take the token out of the
-  // response, present it back. Everything else in this describe block can
-  // pass with that design; only this fails.
-  describe("the forge path — `start`'s own response is not enough", () => {
-    it("REFUSES a caller holding only what `start` returned", async () => {
-      const draft = await startDraft(app, {
-        ...START_PAYLOAD,
-        founderEmail: "victim@example.com",
-      });
-
-      // Everything an attacker has after two HTTP calls: the id and the
-      // resume token, straight out of the 201.
-      const res = await verifyEmail(app, draft.id, draft.resumeToken, draft.resumeToken);
-
-      expect(res.statusCode).toBe(404);
-      expect(storedRow(draft.id)["emailVerifiedAt"]).toBeNull();
-    });
-
-    it("never puts the nonce in `start`'s response, where the forge would find it", async () => {
-      const res = await app.inject({
-        method: "POST",
-        url: "/v1/project-listings",
-        payload: START_PAYLOAD,
-      });
-
-      expect(res.statusCode).toBe(201);
-      // The response is the id and the token, and nothing else — the route's
-      // hard-floor contract, unchanged by #5407.
-      const data = (res.json() as { data: Record<string, unknown> }).data;
-      expect(Object.keys(data).sort()).toEqual(["id", "resumeToken"]);
-
-      // And the nonce is nowhere in the body at all, under any key.
-      await waitForEmail(String(data["id"]));
-      expect(res.body).not.toContain(nonceFromEmail(String(data["id"])));
-    });
-
-    it("stores only a DIGEST — the nonce is not readable off the row", async () => {
-      const { id, nonce } = await startAndMail();
-
-      const row = storedRow(id);
-      expect(row["emailVerifyNonceHash"]).toEqual(expect.any(String));
-      expect(row["emailVerifyNonceHash"]).not.toBe(nonce);
-      // sha-256, hex.
-      expect(row["emailVerifyNonceHash"]).toMatch(/^[0-9a-f]{64}$/);
-    });
-  });
-
-  describe("the emailed nonce is what verifies", () => {
-    it("stamps `email_verified_at` when the link's own nonce is presented", async () => {
-      const { id, resumeToken, nonce } = await startAndMail();
-      expect(storedRow(id)["emailVerifiedAt"]).toBeNull();
-
-      const res = await verifyEmail(app, id, resumeToken, nonce);
-
-      expect(res.statusCode).toBe(200);
-      const stamped = storedRow(id)["emailVerifiedAt"];
-      expect(stamped).toBeInstanceOf(Date);
-      expect((res.json() as { data: { emailVerifiedAt: string } }).data.emailVerifiedAt).toBe(
-        (stamped as Date).toISOString(),
-      );
-    });
-
-    it("is WRITE-ONCE — a second call answers the FIRST stamp and moves nothing", async () => {
-      const { id, resumeToken, nonce } = await startAndMail();
-
-      const first = await verifyEmail(app, id, resumeToken, nonce);
-      const firstStamp = storedRow(id)["emailVerifiedAt"] as Date;
-
-      const second = await verifyEmail(app, id, resumeToken, nonce);
-
-      expect(second.statusCode).toBe(200);
-      expect((storedRow(id)["emailVerifiedAt"] as Date).getTime()).toBe(firstStamp.getTime());
-      expect(second.json()).toEqual(first.json());
-    });
-
-    it("refuses a WRONG nonce, with the same 404 as everything else", async () => {
-      const { id, resumeToken } = await startAndMail();
-
-      const res = await verifyEmail(app, id, resumeToken, "not-the-nonce");
-
-      expect(res.statusCode).toBe(404);
-      expect(res.json()).toEqual({
-        ok: false,
-        error: { code: "not_found", message: "Draft not found" },
-      });
-      expect(storedRow(id)["emailVerifiedAt"]).toBeNull();
-    });
-
-    it("refuses another listing's nonce", async () => {
-      const mine = await startAndMail();
-      const theirs = await startDraft(app, {
-        ...START_PAYLOAD,
-        founderEmail: "grace@example.com",
-      });
-      await waitForEmail(theirs.id);
-
-      const res = await verifyEmail(
-        app,
-        theirs.id,
-        theirs.resumeToken,
-        nonceFromEmail(mine.id),
-      );
-
-      expect(res.statusCode).toBe(404);
-      expect(storedRow(theirs.id)["emailVerifiedAt"]).toBeNull();
-      expect(storedRow(mine.id)["emailVerifiedAt"]).toBeNull();
-    });
-
-    it("refuses a WRONG resume token even with the right nonce", async () => {
-      // The nonce carries the proof, but the token stays in the guard — a
-      // nonce that leaked on its own still opens nothing.
-      const { id, nonce } = await startAndMail();
-
-      const res = await verifyEmail(app, id, "not-the-token", nonce);
-
-      expect(res.statusCode).toBe(404);
-      expect(storedRow(id)["emailVerifiedAt"]).toBeNull();
-    });
-  });
-
-  describe("the error surface is `patch`'s and `submit`'s", () => {
-    it("gives an UNKNOWN id the identical answer to a wrong nonce", async () => {
-      const { id, resumeToken, nonce } = await startAndMail();
-      const wrongNonce = await verifyEmail(app, id, resumeToken, "not-the-nonce");
-      const unknownId = await verifyEmail(
-        app,
-        "prjl_00000000-0000-7000-8000-0000000000ff",
-        resumeToken,
-        nonce,
-      );
-
-      expect(unknownId.statusCode).toBe(wrongNonce.statusCode);
-      expect(unknownId.json()).toEqual(wrongNonce.json());
-    });
-
-    it("refuses a SUBMITTED row — submit clears both digests", async () => {
-      const { id, resumeToken, nonce } = await startAndMail();
-      const draft = { id, resumeToken };
-      await patch(app, draft, { ...APPLICATION_WITHOUT_ADDRESS, address: ADDRESS_PARTS });
-      expect((await submit(app, draft)).statusCode).toBe(200);
-
-      expect(storedRow(id)["emailVerifyNonceHash"]).toBeNull();
-      const res = await verifyEmail(app, id, resumeToken, nonce);
-
-      expect(res.statusCode).toBe(404);
-      expect(storedRow(id)["emailVerifiedAt"]).toBeNull();
-    });
-
-    it("answers 401 when no token is presented at all", async () => {
-      const { id, nonce } = await startAndMail();
-
-      const res = await verifyEmail(app, id, undefined, nonce);
-
-      expect(res.statusCode).toBe(401);
-      expect(res.json()).toEqual({
-        ok: false,
-        error: { code: "unauthorized", message: "A resume token is required" },
-      });
-    });
-
-    it("answers 400 when the body carries no nonce", async () => {
-      const { id, resumeToken } = await startAndMail();
-
-      const res = await verifyEmail(app, id, resumeToken);
-
-      expect(res.statusCode).toBe(400);
-      expect((res.json() as { error: { code: string } }).error.code).toBe("validation_failed");
-      expect(storedRow(id)["emailVerifiedAt"]).toBeNull();
-    });
-
-    it("answers 400 on a malformed id, before any credential is consulted", async () => {
-      const res = await app.inject({
-        method: "POST",
-        url: "/v1/project-listings/drafts/not-an-id/verify-email",
-        headers: bearer("anything"),
-        payload: { verifyNonce: "anything" },
-      });
-
-      expect(res.statusCode).toBe(400);
-      expect((res.json() as { error: { code: string } }).error.code).toBe("validation_failed");
-    });
-
-    it("never returns either credential, on success or failure", async () => {
-      const { id, resumeToken, nonce } = await startAndMail();
-      const ok = await verifyEmail(app, id, resumeToken, nonce);
-      const bad = await verifyEmail(app, id, resumeToken, "not-the-nonce");
-
-      for (const res of [ok, bad]) {
-        expect(res.body).not.toContain(resumeToken);
-        expect(res.body).not.toContain(nonce);
-      }
-      // And nothing but the id and the stamp rides the success body.
-      expect(Object.keys((ok.json() as { data: Record<string, unknown> }).data).sort()).toEqual([
-        "emailVerifiedAt",
-        "id",
-      ]);
-    });
-
-    it("surfaces the stamp on the founder's own draft read", async () => {
-      const { id, resumeToken, nonce } = await startAndMail();
-      await verifyEmail(app, id, resumeToken, nonce);
-
-      const body = draftBody(
-        await patch(app, { id, resumeToken }, { headline: "A headline here" }),
-      );
-
-      expect(body["emailVerifiedAt"]).toBe(
-        (storedRow(id)["emailVerifiedAt"] as Date).toISOString(),
-      );
-      // The nonce digest is an internal column and never rides a response.
-      expect(body["emailVerifyNonceHash"]).toBeUndefined();
-    });
-  });
-
-  describe("a site that sends no resume email can never verify", () => {
-    it("mints a nonce, delivers none, and leaves the row unverifiable", async () => {
-      resumeEmailEnabled = false;
-
-      const draft = await startDraft(app);
-      await Promise.resolve();
-
-      // The nonce exists — `start` cannot know whether the send will happen.
-      expect(storedRow(draft.id)["emailVerifyNonceHash"]).toEqual(expect.any(String));
-      // But nothing was mailed, so nothing outside the server holds it.
-      expect(sendListingResumeEmail).not.toHaveBeenCalled();
-      // And the only credentials anyone has do not verify. That is the
-      // correct outcome, not a gap: nobody has read anything at that address.
-      const res = await verifyEmail(app, draft.id, draft.resumeToken, draft.resumeToken);
-      expect(res.statusCode).toBe(404);
-      expect(storedRow(draft.id)["emailVerifiedAt"]).toBeNull();
-    });
-  });
-});
-
-// ── #6335 — the explicit workspace setup above is load-bearing ────────────
-//
-// Every case in this file states that this suite's site has a workspace.
-// This one takes that away, and proves the statement was doing work rather
-// than decorating the setup: `startProjectListingDraft` resolves the site it
-// is filing against (`resolveWorkspaceIdForSite`, services/project-listings.ts)
-// and refuses BEFORE any row is written. With the shared prisma mock's old
-// permissive default in place this case could not be written at all — every
-// id resolved, so the fail-closed path was unreachable from a route test.
-describe("#6335 — start fails closed when the site names no workspace", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    installStore();
-    mockNoWorkspace(prisma);
-    app = await buildApp();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("answers 503 tenant_unresolved and creates no ProjectListing", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/project-listings",
-      payload: START_PAYLOAD,
-    });
-
-    expect(res.statusCode).toBe(503);
-    expect((res.json() as { error: { code: string } }).error.code).toBe(
-      "tenant_unresolved",
-    );
-    expect(prisma.projectListing.create).not.toHaveBeenCalled();
-    expect(rows).toHaveLength(0);
-  });
-});