create-ailk 0.24.0 → 0.25.1

package/templates/apps/api/src/routes/project-listings/__tests__/public.test.ts

@@ -1,476 +0,0 @@
-// Not marked oss: false (D-48/#5366 escalation) — tests the
-// always-shipping project-listings anonymous surface; see
-// routes/project-listings/me.ts's header comment.
-/**
- * @file public.test.ts
- *
- * THE ACCEPTANCE GATE for `GET /v1/project-listings/public` (#4998 AC4).
- * Real `publicProjectListingsRoute`, mocked `lib/prisma.js`. A five-row
- * fixture (mixed status, decidedAt, waitlistCount) proves the D6 order: the
- * three newest-by-decidedAt `active` rows first, then the rest by
- * waitlistCount desc then decidedAt desc — and that `requested`/`rejected`
- * rows never appear, `founderEmail` never appears on any row, and a
- * malformed `siteKey` is 400.
- *
- * Extended by #5033 with the invariant that is a wrong-way failure rather
- * than a visible one: a row whose window has ELAPSED reads `closed`,
- * computed on this read, with no job having run and nothing having been
- * written. Plus the per-site `featured` gate.
- *
- * Narrowed by #5036 D6b: a null window is no longer a free pass. Only a
- * FEATURED row (never a time-boxed experiment) reads `active` without one; a
- * non-featured row with no window is a data error and fails CLOSED. The row
- * itself also changed shape — `audience`/`stage` are gone,
- * `product`/`commitment`/`teamComposition`/`faqs`/`anythingElse`/`address`/
- * `consentAt` are new, and the waitlist join reads `experimentKey` straight
- * off the listing (D6d) rather than translating an id through
- * `WaitlistExperiment`.
- */
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-import { projectListingPublicSchema } from "@working-theory/validation";
-
-// `services/project-listings.ts` imports `routeLead` from `lead-routing.js`
-// (used by the draft-submit path, not by this route) at module scope, which transitively
-// imports `@working-theory/email` and `@working-theory/license` — mocked
-// here purely so that import chain resolves, mirroring
-// `routes/leads/__tests__/index.test.ts`'s discipline.
-jest.mock("@working-theory/email", () => ({
-  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
-  // #5406 — `start` now reaches the resume email. Declared here for the reason
-  // docs/lessons/project-listings/04 records: a mock factory that omits an
-  // export the code under test calls leaves it `undefined` at the callsite.
-  // These suites configure no `resumeEmail`, so the send short-circuits before
-  // this is reached; it is declared so a future fixture that DOES configure
-  // one fails on its assertion rather than on a missing mock.
-  sendListingResumeEmail: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-resume" }),
-}));
-jest.mock("@working-theory/license", () => ({
-  checkLicense: jest.fn().mockResolvedValue({
-    tier: "free",
-    plan: null,
-    features: [],
-    expiresAt: null,
-    revoked: false,
-  }),
-}));
-
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../../../lib/prisma.js", () => ({
-  prisma: {
-    projectListing: { findMany: jest.fn() },
-    siteListingConfig: { findUnique: jest.fn() },
-    waitlistExperiment: { findMany: jest.fn() },
-    waitlistScore: { groupBy: jest.fn() },
-  },
-}));
-
-import { prisma } from "../../../lib/prisma.js";
-import { publicProjectListingsRoute } from "../public.js";
-
-const SITE = "site-1";
-/**
- * The query names the site by its PUBLIC KEY now (#5048 D2) — one identifier
- * for the whole mountable contract, resolved server-side through
- * `SiteListingConfig.publicKey`.
- */
-const SITE_KEY = "site-1-public-key";
-
-/**
- * The `SiteListingConfig.data` blob this site is running on, per test. The
- * config delegate serves TWO lookups now, so a test that wants a different
- * config sets this rather than re-stubbing `findUnique` — a blanket
- * `mockResolvedValue` would break the `publicKey` resolution the route makes
- * first.
- */
-let configData: Record<string, unknown> | null = null;
-
-const opt = (value: string, label: string) => ({ value, label });
-const QUESTIONS = {
-  q2: { prompt: "x", options: [opt("scale", "Scale"), opt("just-curious", "Just curious")] },
-  q3: { prompt: "x", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
-  q4: { prompt: "x", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
-  q5: { prompt: "x", options: [opt("urgent", "Now"), opt("planning", "Soon"), opt("exploring", "Someday")] },
-  q6: {
-    prompt: "x",
-    options: [opt("low", "Low"), opt("medium", "Medium"), opt("high", "High"), opt("critical", "Critical")],
-  },
-  q7: { prompt: "x" },
-  extras: [],
-};
-
-function makeRow(overrides: Partial<Record<string, unknown>>) {
-  return {
-    siteId: SITE,
-    leadId: "lead_00000000-0000-7000-8000-000000000001",
-    name: "A Project",
-    oneLiner: "A one-liner",
-    problem: "The problem",
-    url: null,
-    // #5036 D2/D5 — the `product` ladder replaced `stage`, `audience` is gone,
-    // and these five carry what the tile and detail page render.
-    product: "working-prototype",
-    commitment: "part-time",
-    teamComposition: "just-me",
-    faqs: null,
-    anythingElse: null,
-    address: "1 Example Street, Exampleton, EX1 2AM",
-    questions: QUESTIONS,
-    founderName: "Some Founder",
-    founderEmail: "founder@example.com",
-    // #5407 — a row that filled in EVERY new column, which is the shape that
-    // can actually leak. A null phone would pass the public-read tests below
-    // whether or not the strip existed.
-    founderFirstName: "Some",
-    founderLastName: "Founder",
-    founderPhone: "+12015550123",
-    emailVerifiedAt: new Date("2026-08-02T00:00:00.000Z"),
-    founderCompany: null,
-    headline: null,
-    logoMarkUrl: null,
-    logoWordmarkUrl: null,
-    solution: null,
-    featured: false,
-    consentAt: new Date("2026-08-01T00:00:00.000Z"),
-    issueUrl: null,
-    experimentKey: null,
-    // A LIVE window by default. Since #5036 D6b a non-featured `active` row
-    // with no window reads `closed` (the fail-closed error branch), so these
-    // fixtures have to carry one to be the ordinary active rows the ordering
-    // tests are about.
-    windowEndsAt: new Date("2099-01-01T00:00:00.000Z"),
-    createdAt: new Date("2026-08-01T00:00:00.000Z"),
-    updatedAt: new Date("2026-08-01T00:00:00.000Z"),
-    decidedBy: "alice",
-    ...overrides,
-  };
-}
-
-// Five rows: two requested/rejected (excluded), three `active` with a
-// clear decidedAt ranking, two of which also carry a distinguishing
-// waitlistCount for the "rest" ordering below.
-const ROW_NEWEST = makeRow({
-  id: "prjl_00000000-0000-7000-8000-000000000001",
-  slug: "newest",
-  status: "active",
-  decidedAt: new Date("2026-09-05T00:00:00.000Z"),
-  experimentKey: "exp-newest",
-});
-const ROW_SECOND = makeRow({
-  id: "prjl_00000000-0000-7000-8000-000000000002",
-  slug: "second",
-  status: "active",
-  decidedAt: new Date("2026-09-04T00:00:00.000Z"),
-});
-const ROW_THIRD = makeRow({
-  id: "prjl_00000000-0000-7000-8000-000000000003",
-  slug: "third",
-  status: "active",
-  decidedAt: new Date("2026-09-03T00:00:00.000Z"),
-});
-// Two more approved rows, older decidedAt (excluded from the top-3), whose
-// relative order among "the rest" is decided by waitlistCount desc.
-const ROW_REST_LOW_COUNT = makeRow({
-  id: "prjl_00000000-0000-7000-8000-000000000004",
-  slug: "rest-low",
-  status: "active",
-  decidedAt: new Date("2026-08-20T00:00:00.000Z"),
-  experimentKey: "exp-rest-low",
-});
-const ROW_REST_HIGH_COUNT = makeRow({
-  id: "prjl_00000000-0000-7000-8000-000000000005",
-  slug: "rest-high",
-  status: "active",
-  decidedAt: new Date("2026-08-10T00:00:00.000Z"),
-  experimentKey: "exp-rest-high",
-});
-const ROW_REQUESTED = makeRow({
-  id: "prjl_00000000-0000-7000-8000-000000000006",
-  slug: "still-requested",
-  status: "requested",
-  decidedAt: null,
-});
-const ROW_REJECTED = makeRow({
-  id: "prjl_00000000-0000-7000-8000-000000000007",
-  slug: "was-rejected",
-  status: "rejected",
-  decidedAt: new Date("2026-09-06T00:00:00.000Z"),
-});
-
-const ALL_ROWS = [
-  ROW_NEWEST,
-  ROW_SECOND,
-  ROW_THIRD,
-  ROW_REST_LOW_COUNT,
-  ROW_REST_HIGH_COUNT,
-  ROW_REQUESTED,
-  ROW_REJECTED,
-];
-
-const COUNTS_BY_KEY: Record<string, number> = {
-  "exp-newest": 2,
-  "exp-rest-low": 1,
-  "exp-rest-high": 9,
-};
-
-function installFixtureMocks(): void {
-  (prisma.projectListing.findMany as jest.Mock).mockImplementation(
-    ({ where }: { where: { siteId: string; status: string } }) =>
-      Promise.resolve(
-        ALL_ROWS.filter((r) => r.siteId === where.siteId && r.status === where.status),
-      ),
-  );
-  // No SiteListingConfig row by default — the platform's schema defaults
-  // apply, which leave `featuredEnabled` false. The `publicKey` branch still
-  // resolves SITE_KEY, since the route cannot reach the read without it.
-  configData = null;
-  (prisma.siteListingConfig.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { siteId?: string; publicKey?: string } }) => {
-      if (where.publicKey !== undefined) {
-        return Promise.resolve(where.publicKey === SITE_KEY ? { siteId: SITE } : null);
-      }
-      return Promise.resolve(configData === null ? null : { data: configData });
-    },
-  );
-  // No `WaitlistExperiment` read is installed on purpose: since #5036 D6d the
-  // count is keyed on the `experimentKey` the listing already holds, so the
-  // id-to-key hop this route used to make is gone. A test below asserts it
-  // stays gone.
-  (prisma.waitlistScore.groupBy as jest.Mock).mockImplementation(
-    ({ where }: { where: { experimentKey: { in: string[] } } }) =>
-      Promise.resolve(
-        where.experimentKey.in
-          .filter((experimentKey) => (COUNTS_BY_KEY[experimentKey] ?? 0) > 0)
-          .map((experimentKey) => ({ experimentKey, _count: { _all: COUNTS_BY_KEY[experimentKey] } })),
-      ),
-  );
-}
-
-async function buildApp(): Promise<FastifyInstance> {
-  const app = Fastify();
-  await app.register(publicProjectListingsRoute);
-  await app.ready();
-  return app;
-}
-
-describe("GET /v1/project-listings/public", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    installFixtureMocks();
-    app = await buildApp();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("returns the D6 order: three newest-by-decidedAt first, then the rest by waitlistCount desc then decidedAt desc", async () => {
-    const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
-    expect(res.statusCode).toBe(200);
-    const rows = res.json().data as Array<{ slug: string }>;
-    expect(rows.map((r) => r.slug)).toEqual(["newest", "second", "third", "rest-high", "rest-low"]);
-  });
-
-  it("never returns a requested or rejected row", async () => {
-    const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
-    const slugs = (res.json().data as Array<{ slug: string }>).map((r) => r.slug);
-    expect(slugs).not.toContain("still-requested");
-    expect(slugs).not.toContain("was-rejected");
-  });
-
-  it("never carries founderEmail on any row", async () => {
-    const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
-    const body = JSON.stringify(res.json());
-    expect(body).not.toContain("founderEmail");
-    expect(body).not.toContain("founder@example.com");
-    for (const row of res.json().data) {
-      expect(projectListingPublicSchema.safeParse(row).success).toBe(true);
-    }
-  });
-
-  // #5407 — the phone and the verification stamp join `founderEmail` on the
-  // never-public list, and the fixture above carries a real value for each so
-  // this test can actually fail. Asserted on the SERIALIZED body, not on the
-  // parsed rows: `.strict()` would reject an extra key, but only a string
-  // search proves the VALUE is not riding some other field.
-  it("never carries founderPhone or emailVerifiedAt on any row (#5407)", async () => {
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/project-listings/public?siteKey=${SITE_KEY}`,
-    });
-
-    const body = JSON.stringify(res.json());
-    expect(body).not.toContain("founderPhone");
-    expect(body).not.toContain("+12015550123");
-    expect(body).not.toContain("emailVerifiedAt");
-    expect(body).not.toContain("2026-08-02");
-    // The two name PARTS do ride the public read, deliberately: they are the
-    // same information as `founderName`, which has always been public.
-    expect(body).toContain("founderFirstName");
-  });
-
-  it("400s on a malformed siteKey", async () => {
-    const res = await app.inject({ method: "GET", url: "/v1/project-listings/public?siteKey=" });
-    expect(res.statusCode).toBe(400);
-  });
-
-  it("400s when siteKey is missing entirely", async () => {
-    const res = await app.inject({ method: "GET", url: "/v1/project-listings/public" });
-    expect(res.statusCode).toBe(400);
-  });
-
-  // ── #5033 — `closed` is computed, not stored ────────────────────────────
-
-  describe("the computed closed state", () => {
-    const statusOf = (body: { data: Array<{ slug: string; status: string }> }, slug: string) =>
-      body.data.find((r) => r.slug === slug)?.status;
-
-    it("reads a row whose window has ELAPSED as closed, with no job having run", async () => {
-      const elapsed = makeRow({
-        id: "prjl_00000000-0000-7000-8000-000000000008",
-        slug: "window-elapsed",
-        status: "active",
-        decidedAt: new Date("2026-07-01T00:00:00.000Z"),
-        windowEndsAt: new Date("2026-08-01T00:00:00.000Z"),
-      });
-      (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([elapsed]);
-
-      const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
-      expect(res.statusCode).toBe(200);
-      expect(statusOf(res.json(), "window-elapsed")).toBe("closed");
-      // Nothing was written to produce that answer.
-      expect(prisma.projectListing.update).toBeUndefined();
-    });
-
-    it("reads a row whose window is STILL OPEN as active", async () => {
-      const open = makeRow({
-        id: "prjl_00000000-0000-7000-8000-000000000009",
-        slug: "window-open",
-        status: "active",
-        decidedAt: new Date("2026-09-01T00:00:00.000Z"),
-        windowEndsAt: new Date("2099-01-01T00:00:00.000Z"),
-      });
-      (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([open]);
-
-      const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
-      expect(statusOf(res.json(), "window-open")).toBe("active");
-    });
-
-    // #5036 D6b. A null window used to mean "nothing to elapse, stay active".
-    // It now means one of two opposite things depending on the row's own
-    // `featured` flag, and the split is deliberate: the operator's products
-    // are featured rows with no meaningful window and must not vanish from the
-    // shelf, while a non-featured row with nothing bounding it is a data error
-    // that must not stay publicly open.
-    it("leaves a FEATURED row with no window at all active — it is not a time-boxed experiment", async () => {
-      const featuredNoWindow = makeRow({
-        id: "prjl_00000000-0000-7000-8000-00000000000a",
-        slug: "featured-no-window",
-        status: "active",
-        decidedAt: new Date("2026-09-01T00:00:00.000Z"),
-        featured: true,
-        windowEndsAt: null,
-      });
-      (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([featuredNoWindow]);
-
-      const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
-      expect(statusOf(res.json(), "featured-no-window")).toBe("active");
-    });
-
-    it("reads a NON-featured row with no window as closed — failing toward the closed shelf", async () => {
-      const unboundedNoWindow = makeRow({
-        id: "prjl_00000000-0000-7000-8000-00000000000b",
-        slug: "unbounded",
-        status: "active",
-        decidedAt: new Date("2026-09-01T00:00:00.000Z"),
-        featured: false,
-        windowEndsAt: null,
-      });
-      (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([unboundedNoWindow]);
-
-      const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
-      expect(statusOf(res.json(), "unbounded")).toBe("closed");
-    });
-
-    // The row's OWN flag decides the exemption, not the site's
-    // `featuredEnabled` switch — that switch governs whether the flag
-    // SURFACES on a read, not whether the listing is time-boxed.
-    it("exempts on the row's own flag even where the site does not surface it", async () => {
-      const featuredNoWindow = makeRow({
-        id: "prjl_00000000-0000-7000-8000-00000000000c",
-        slug: "featured-hidden-flag",
-        status: "active",
-        decidedAt: new Date("2026-09-01T00:00:00.000Z"),
-        featured: true,
-        windowEndsAt: null,
-      });
-      (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([featuredNoWindow]);
-      configData = { maxWindowDays: 30, defaultWindowDays: 14, featuredEnabled: false };
-
-      const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
-      const row = res.json().data.find((r: { slug: string }) => r.slug === "featured-hidden-flag");
-      expect(row.featured).toBe(false); // not surfaced
-      expect(row.status).toBe("active"); // still exempt
-    });
-
-    it("counts the waitlist through the listing's own experimentKey, in one hop", async () => {
-      await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
-      expect(prisma.waitlistScore.groupBy).toHaveBeenCalledTimes(1);
-      expect(prisma.waitlistScore.groupBy).toHaveBeenCalledWith({
-        by: ["experimentKey"],
-        // #6258 AC-6 — the fenced read now filters the CONSTRAINED column
-        // beside `siteId`; the two are equal by the workspace_site_agree CHECK.
-        where: {
-          siteId: SITE,
-          workspaceId: SITE,
-          experimentKey: { in: expect.arrayContaining(["exp-newest"]) },
-        },
-        _count: { _all: true },
-      });
-      // The id-to-key translation read is gone with #5036 D6d.
-      expect(prisma.waitlistExperiment.findMany).not.toHaveBeenCalled();
-    });
-
-    it("selects on the STORED status, so the query never asks the database for `closed`", async () => {
-      await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
-      const where = (prisma.projectListing.findMany as jest.Mock).mock.calls[0][0].where;
-      expect(where.status).toBe("active");
-    });
-  });
-
-  // ── #5033 — the per-site featured gate ──────────────────────────────────
-
-  describe("the featured flag", () => {
-    const featuredRow = makeRow({
-      id: "prjl_00000000-0000-7000-8000-000000000010",
-      slug: "is-featured",
-      status: "active",
-      decidedAt: new Date("2026-09-01T00:00:00.000Z"),
-      featured: true,
-    });
-
-    beforeEach(() => {
-      (prisma.projectListing.findMany as jest.Mock).mockResolvedValue([featuredRow]);
-    });
-
-    it("surfaces the flag where the site's config enables it", async () => {
-      configData = { maxWindowDays: 30, defaultWindowDays: 14, featuredEnabled: true };
-      const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
-      expect(res.json().data[0].featured).toBe(true);
-    });
-
-    it("never surfaces the flag for a site that has not enabled a featured shelf", async () => {
-      configData = { maxWindowDays: 30, defaultWindowDays: 14, featuredEnabled: false };
-      const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
-      expect(res.json().data[0].featured).toBe(false);
-    });
-
-    it("defaults to not surfacing it for a site with no config row", async () => {
-      configData = null;
-      const res = await app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
-      expect(res.json().data[0].featured).toBe(false);
-    });
-  });
-});