create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/services/__tests__/spoke-resolution.test.ts

@@ -1,660 +0,0 @@
-/**
- * @file spoke-resolution.test.ts
- *
- * `resolveCallerSite(request)` and the public resolver's spoke arms (#7532,
- * spec docs/specs/7532-a-spoke-s-public-reads-spec.md D3, AC-1, AC-3, AC-4),
- * and its keyless branch since #7633 (spec
- * docs/specs/7633-expected-a-keyless-public-read-spec.md D1–D3, AC-1, AC-2,
- * AC-5): a hub — a deployment whose registry holds a row — refuses a keyless
- * call exactly as it refuses an unknown key, with no switch set.
- *
- * A spoke names itself with ONE request header, `x-ailk-spoke-key`, looked up
- * by its SHA-256 digest in the hub's registry. Nothing else on the request —
- * a workspace id, `Host`, `X-Forwarded-Host`, `Origin` — selects a workspace.
- *
- * Fixture (spec § 5): three workspaces — the sentinel default `F`, `W1`, `W2`;
- * spokes `S1` → `W1`, `S1b` → `W1`, `S2` → `W2`, each with its own key.
- * `db.spoke.findUnique` answers by `credentialHash`; `db.spoke.findFirst` — the
- * "is this a hub" read — answers `{ id: S1 }` (a non-empty registry) unless a
- * case empties it.
- *
- * External dependency boundaries mocked:
- *   - @working-theory/database (via the prisma singleton; __mocks__/prisma.ts)
- *   - lib/content-adapter.js (so the adapter the resolver picks is observable)
- */
-import { createHash } from "node:crypto";
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../../lib/prisma.js");
-// eslint-disable-next-line no-restricted-syntax -- AC-1 asserts WHICH adapter the resolver asks for (workspace-scoped vs shared mdx); the double records that argument
-jest.mock("../../lib/content-adapter.js", () => ({
-  getContentAdapter: jest.fn(() => ({ kind: "adapter-double" })),
-}));
-
-import type { FastifyRequest } from "fastify";
-
-import * as configModule from "../../config/index.js";
-import type { HubSpokeKeyMode } from "../../config/index.js";
-import { getContentAdapter } from "../../lib/content-adapter.js";
-import { mockSentinelWorkspaceExists } from "../../lib/__mocks__/prisma.js";
-import { prisma } from "../../lib/prisma.js";
-import {
-  __resetHubStatusForTests,
-  resolveCallerSite,
-  resolvePublicContentAdapter,
-  resolvePublicWorkspace,
-} from "../public-site-resolver.js";
-
-const db = jest.mocked(prisma);
-
-const W1 = "wksp_01920000-0000-7000-8000-0000000000b1";
-const W2 = "wksp_01920000-0000-7000-8000-0000000000b2";
-const S1 = "spoke_01920000-0000-7000-8000-0000000000c1";
-const S1B = "spoke_01920000-0000-7000-8000-0000000000c2";
-const S2 = "spoke_01920000-0000-7000-8000-0000000000c3";
-
-/** A well-formed 52-character spoke key, distinct per tag. */
-function spokeKey(tag: string): string {
-  return `ailk_spk_${tag}${"x".repeat(43 - tag.length)}`;
-}
-const KEY_S1 = spokeKey("S1");
-const KEY_S1B = spokeKey("S1b");
-const KEY_S2 = spokeKey("S2");
-const KEY_UNKNOWN = spokeKey("nobody");
-
-const digest = (key: string) => createHash("sha256").update(key).digest("hex");
-
-type SpokeRow = { id: string; workspaceId: string; revokedAt: Date | null };
-
-/**
- * Program the registry: `db.spoke.findUnique` answers by digest, and
- * `db.spoke.findFirst` reports a non-empty registry (#7633 D1).
- */
-function seedRegistry(revoked: readonly string[] = []): void {
-  const rows = new Map<string, SpokeRow>([
-    [digest(KEY_S1), { id: S1, workspaceId: W1, revokedAt: null }],
-    [digest(KEY_S1B), { id: S1B, workspaceId: W1, revokedAt: null }],
-    [digest(KEY_S2), { id: S2, workspaceId: W2, revokedAt: null }],
-  ]);
-  for (const row of rows.values()) {
-    if (revoked.includes(row.id)) row.revokedAt = new Date();
-  }
-  db.spoke.findUnique.mockImplementation((async ({
-    where,
-  }: {
-    where: { credentialHash: string };
-  }) => rows.get(where.credentialHash) ?? null) as never);
-  db.spoke.findFirst.mockResolvedValue({ id: S1 } as never);
-}
-
-/** An empty registry: a deployment with no spoke is not a hub (#7633 D1). */
-function emptyRegistry(): void {
-  db.spoke.findFirst.mockResolvedValue(null);
-}
-
-/** A request double carrying only what the resolver may read. */
-function requestWith(headers: Record<string, string | string[]>): {
-  request: FastifyRequest;
-  warn: jest.Mock;
-} {
-  const warn = jest.fn();
-  // eslint-disable-next-line no-restricted-syntax -- a FastifyRequest double carrying only the two members the resolver reads (headers, log)
-  const request = {
-    headers,
-    log: { warn, info: jest.fn(), error: jest.fn() },
-  } as unknown as FastifyRequest;
-  return { request, warn };
-}
-
-function setMode(mode: HubSpokeKeyMode): void {
-  jest.replaceProperty(configModule, "config", {
-    ...configModule.config,
-    AILK_HUB_REQUIRE_SPOKE_KEY: mode,
-  });
-}
-
-/** No logged object may carry a key, its digest or its 17-character prefix. */
-function expectNoSecretIn(log: jest.Mock): void {
-  const serialized = JSON.stringify(log.mock.calls);
-  for (const key of [KEY_S1, KEY_S1B, KEY_S2, KEY_UNKNOWN]) {
-    expect(serialized).not.toContain(key);
-    expect(serialized).not.toContain(digest(key));
-    expect(serialized).not.toContain(key.slice(0, 17));
-  }
-}
-
-const savedAdapter = process.env.CONTENT_ADAPTER;
-const savedDatabaseUrl = process.env.DATABASE_URL;
-const savedMode = process.env.AILK_HUB_REQUIRE_SPOKE_KEY;
-
-beforeEach(() => {
-  jest.resetAllMocks();
-  (getContentAdapter as jest.Mock).mockReturnValue({ kind: "adapter-double" });
-  process.env.DATABASE_URL = "postgres://stub";
-  process.env.CONTENT_ADAPTER = "database";
-  seedRegistry();
-  mockSentinelWorkspaceExists(db, W1, W2);
-  db.workspace.count.mockResolvedValue(3);
-  setMode("auto");
-  __resetHubStatusForTests();
-});
-
-afterEach(() => {
-  jest.restoreAllMocks();
-  if (savedAdapter === undefined) delete process.env.CONTENT_ADAPTER;
-  else process.env.CONTENT_ADAPTER = savedAdapter;
-  if (savedDatabaseUrl === undefined) delete process.env.DATABASE_URL;
-  else process.env.DATABASE_URL = savedDatabaseUrl;
-  if (savedMode === undefined) delete process.env.AILK_HUB_REQUIRE_SPOKE_KEY;
-  else process.env.AILK_HUB_REQUIRE_SPOKE_KEY = savedMode;
-});
-
-describe("resolveCallerSite — a registered spoke (AC-1)", () => {
-  it.each([
-    [KEY_S1, S1, W1],
-    [KEY_S1B, S1B, W1],
-    [KEY_S2, S2, W2],
-  ])("resolves its key to its own workspace", async (key, spokeId, workspaceId) => {
-    const { request, warn } = requestWith({ "x-ailk-spoke-key": key });
-
-    await expect(resolveCallerSite(request)).resolves.toEqual({
-      kind: "spoke",
-      spokeId,
-      workspaceId,
-    });
-    expect(db.spoke.findUnique).toHaveBeenCalledTimes(1);
-    expect(db.spoke.findUnique).toHaveBeenCalledWith(
-      expect.objectContaining({ where: { credentialHash: digest(key) } }),
-    );
-    expectNoSecretIn(warn);
-  });
-
-  it("trims the header value before hashing it", async () => {
-    const { request } = requestWith({ "x-ailk-spoke-key": `  ${KEY_S2} ` });
-    await expect(resolveCallerSite(request)).resolves.toMatchObject({
-      kind: "spoke",
-      workspaceId: W2,
-    });
-  });
-
-  it("ignores a workspace id, host and origin a spoke ALSO sends", async () => {
-    const { request } = requestWith({
-      "x-ailk-spoke-key": KEY_S1,
-      host: "w2.example",
-      "x-forwarded-host": "w2.example",
-      origin: "https://w2.example",
-      "x-ailk-workspace-id": W2,
-    });
-    await expect(resolveCallerSite(request)).resolves.toEqual({
-      kind: "spoke",
-      spokeId: S1,
-      workspaceId: W1,
-    });
-  });
-});
-
-describe("resolveCallerSite — fail closed (AC-3)", () => {
-  it("(i) an unregistered key is refused as key-unknown", async () => {
-    const { request, warn } = requestWith({ "x-ailk-spoke-key": KEY_UNKNOWN });
-    await expect(resolveCallerSite(request)).resolves.toEqual({
-      kind: "refused",
-      reason: "key-unknown",
-    });
-    expect(warn).toHaveBeenCalledWith(
-      { reason: "key-unknown" },
-      expect.any(String),
-    );
-    expectNoSecretIn(warn);
-  });
-
-  it("a revoked key is refused as key-revoked, and only that key", async () => {
-    seedRegistry([S1]);
-    const revoked = requestWith({ "x-ailk-spoke-key": KEY_S1 });
-    await expect(resolveCallerSite(revoked.request)).resolves.toEqual({
-      kind: "refused",
-      reason: "key-revoked",
-    });
-    expect(revoked.warn).toHaveBeenCalledWith(
-      { reason: "key-revoked", spokeId: S1 },
-      expect.any(String),
-    );
-    expectNoSecretIn(revoked.warn);
-
-    const sibling = requestWith({ "x-ailk-spoke-key": KEY_S1B });
-    await expect(resolveCallerSite(sibling.request)).resolves.toMatchObject({
-      kind: "spoke",
-      workspaceId: W1,
-    });
-  });
-
-  it.each<[string, string | string[]]>([
-    ["a duplicated header, as Node joins it", `${KEY_S1}, ${KEY_S2}`],
-    ["a string[]", [KEY_S1, KEY_S2]],
-    ["an empty value", ""],
-    ["a blank value", "   "],
-    ["a 129-character value", "k".repeat(129)],
-    ["a non-ASCII value", `${KEY_S1.slice(0, 40)}é`],
-    ["a value carrying a control character", `${KEY_S1.slice(0, 40)}\u0001`],
-  ])("(ii)/(iii) %s is refused as key-malformed, before any lookup", async (_label, value) => {
-    const { request, warn } = requestWith({ "x-ailk-spoke-key": value });
-    await expect(resolveCallerSite(request)).resolves.toEqual({
-      kind: "refused",
-      reason: "key-malformed",
-    });
-    expect(db.spoke.findUnique).not.toHaveBeenCalled();
-    expectNoSecretIn(warn);
-  });
-
-  it("(v) mode \"on\" refuses a header-less request whatever host, origin or workspace header it carries", async () => {
-    setMode("on");
-    const { request } = requestWith({
-      host: "w1.example",
-      "x-forwarded-host": "w1.example",
-      origin: "https://w1.example",
-      "x-ailk-workspace-id": W1,
-    });
-    await expect(resolveCallerSite(request)).resolves.toEqual({
-      kind: "refused",
-      reason: "key-required",
-    });
-    expect(db.spoke.findUnique).not.toHaveBeenCalled();
-  });
-});
-
-describe("resolveCallerSite — the registry module is loaded only when a key needs it (AC-3 iv, AC-4)", () => {
-  /**
-   * A factory that throws when evaluated: requiring `lib/spoke-store.js` at
-   * all fails the test. `isolateModules` gives the resolver a fresh module
-   * registry, so a previous case's import cannot satisfy it.
-   */
-  function withThrowingSpokeStore(
-    run: (mod: typeof import("../public-site-resolver.js")) => Promise<void>,
-  ): Promise<void> {
-    return new Promise<void>((resolve, reject) => {
-      jest.isolateModules(() => {
-        jest.doMock("../../lib/spoke-store.js", () => {
-          throw new Error("lib/spoke-store.js must not be imported");
-        });
-        // A fresh registry instance, required after doMock.
-        const mod = require("../public-site-resolver.js") as typeof import("../public-site-resolver.js");
-        run(mod).then(resolve, reject);
-      });
-    });
-  }
-
-  afterEach(() => {
-    jest.dontMock("../../lib/spoke-store.js");
-  });
-
-  it("with DATABASE_URL unset, a header-less request is anonymous: no registry read, no registry import (#7633 AC-2)", async () => {
-    delete process.env.DATABASE_URL;
-    await withThrowingSpokeStore(async (mod) => {
-      const { request } = requestWith({});
-      await expect(mod.resolveCallerSite(request)).resolves.toEqual({
-        kind: "anonymous",
-      });
-    });
-    expect(db.spoke.findFirst).not.toHaveBeenCalled();
-    expect(db.spoke.findUnique).not.toHaveBeenCalled();
-  });
-
-  it("with DATABASE_URL unset, a bare request object with no headers at all is anonymous (the frozen suite's shape)", async () => {
-    delete process.env.DATABASE_URL;
-    await withThrowingSpokeStore(async (mod) => {
-      await expect(
-        mod.resolveCallerSite({} as FastifyRequest),
-      ).resolves.toEqual({ kind: "anonymous" });
-    });
-  });
-
-  it("mode \"off\" on a hub: a header-less request is anonymous, with no registry import (#7633 AC-5)", async () => {
-    // The isolated resolver reads a fresh config, parsed from the environment.
-    process.env.AILK_HUB_REQUIRE_SPOKE_KEY = "false";
-    await withThrowingSpokeStore(async (mod) => {
-      const { request } = requestWith({});
-      await expect(mod.resolveCallerSite(request)).resolves.toEqual({
-        kind: "anonymous",
-      });
-    });
-  });
-
-  it("(iv) a valid-looking key with DATABASE_URL unset is no-database, with no registry import", async () => {
-    delete process.env.DATABASE_URL;
-    await withThrowingSpokeStore(async (mod) => {
-      const { request, warn } = requestWith({ "x-ailk-spoke-key": KEY_S1 });
-      await expect(mod.resolveCallerSite(request)).resolves.toEqual({
-        kind: "refused",
-        reason: "no-database",
-      });
-      expectNoSecretIn(warn);
-    });
-    expect(db.spoke.findUnique).not.toHaveBeenCalled();
-  });
-});
-
-describe("resolvePublicWorkspace — the spoke prefix (D3)", () => {
-  it.each(["database", "mdx"])(
-    "a spoke resolves to its own workspace on the %s adapter",
-    async (adapter) => {
-      process.env.CONTENT_ADAPTER = adapter;
-      const one = requestWith({ "x-ailk-spoke-key": KEY_S1 });
-      const two = requestWith({ "x-ailk-spoke-key": KEY_S2 });
-
-      await expect(resolvePublicWorkspace(one.request)).resolves.toEqual({
-        kind: "resolved",
-        workspaceId: W1,
-      });
-      await expect(resolvePublicWorkspace(two.request)).resolves.toEqual({
-        kind: "resolved",
-        workspaceId: W2,
-      });
-      // The one-workspace predicate is never consulted for a spoke.
-      expect(db.workspace.count).not.toHaveBeenCalled();
-    },
-  );
-
-  it("a refused key is unresolved (spoke-refused), never the alias or the default", async () => {
-    const { request } = requestWith({ "x-ailk-spoke-key": KEY_UNKNOWN });
-    await expect(resolvePublicWorkspace(request)).resolves.toEqual({
-      kind: "unresolved",
-      reason: "spoke-refused",
-    });
-    expect(db.workspace.count).not.toHaveBeenCalled();
-  });
-
-  it("with an empty registry, a header-less request keeps today's answer — ambiguous on three workspaces (#7633 AC-2)", async () => {
-    emptyRegistry();
-    const { request } = requestWith({});
-    await expect(resolvePublicWorkspace(request)).resolves.toEqual({
-      kind: "unresolved",
-      reason: "ambiguous",
-    });
-  });
-});
-
-describe("resolvePublicContentAdapter — a spoke's content read (AC-1)", () => {
-  it("on the database adapter, reads the spoke's own workspace", async () => {
-    const { request } = requestWith({ "x-ailk-spoke-key": KEY_S1 });
-
-    await expect(resolvePublicContentAdapter(request)).resolves.toEqual({
-      kind: "adapter-double",
-    });
-    expect(getContentAdapter).toHaveBeenCalledTimes(1);
-    expect(getContentAdapter).toHaveBeenCalledWith({
-      workspaceId: W1,
-      prisma: db,
-    });
-  });
-
-  it("on the mdx adapter, keeps reading the shared mdx source — no workspace argument", async () => {
-    process.env.CONTENT_ADAPTER = "mdx";
-    const { request } = requestWith({ "x-ailk-spoke-key": KEY_S1 });
-
-    await resolvePublicContentAdapter(request);
-    expect(getContentAdapter).toHaveBeenCalledTimes(1);
-    expect(getContentAdapter).toHaveBeenCalledWith();
-  });
-
-  it.each<[string, Record<string, string>, HubSpokeKeyMode]>([
-    ["an unregistered key", { "x-ailk-spoke-key": KEY_UNKNOWN }, "auto"],
-    ["a malformed key", { "x-ailk-spoke-key": "" }, "auto"],
-    ["a header-less request in mode \"on\"", { host: "w1.example" }, "on"],
-    ["a header-less request on a hub, with no switch set (#7633 AC-1)", { host: "w1.example" }, "auto"],
-  ])("%s resolves to null — no adapter at all (AC-3)", async (_label, headers, mode) => {
-    setMode(mode);
-    const { request, warn } = requestWith(headers);
-
-    await expect(resolvePublicContentAdapter(request)).resolves.toBeNull();
-    expect(getContentAdapter).not.toHaveBeenCalled();
-    expectNoSecretIn(warn);
-  });
-});
-
-// ── #7633 — the keyless branch on a hub ──────────────────────────────────────
-
-describe("resolveCallerSite — a keyless call on a hub is refused like an unknown key (#7633 AC-1)", () => {
-  it("is refused as key-required after one registry read with no where, and no key lookup", async () => {
-    const { request, warn } = requestWith({});
-
-    await expect(resolveCallerSite(request)).resolves.toEqual({
-      kind: "refused",
-      reason: "key-required",
-    });
-    expect(db.spoke.findFirst).toHaveBeenCalledTimes(1);
-    expect(db.spoke.findFirst).toHaveBeenCalledWith({ select: { id: true } });
-    expect(db.spoke.findUnique).not.toHaveBeenCalled();
-    expect(warn).toHaveBeenCalledWith(
-      { reason: "key-required" },
-      expect.any(String),
-    );
-  });
-
-  it("is refused when the registry's only row is revoked — revocation never re-opens keyless access", async () => {
-    seedRegistry([S1, S1B, S2]);
-    const { request } = requestWith({});
-
-    await expect(resolveCallerSite(request)).resolves.toEqual({
-      kind: "refused",
-      reason: "key-required",
-    });
-    expect(db.spoke.findFirst).toHaveBeenCalledWith({ select: { id: true } });
-    expect(db.spoke.findUnique).not.toHaveBeenCalled();
-  });
-
-  it("is refused whatever host, origin or workspace header it carries", async () => {
-    const { request } = requestWith({
-      host: "w1.example",
-      "x-forwarded-host": "w1.example",
-      origin: "https://w1.example",
-      "x-ailk-workspace-id": W1,
-    });
-
-    await expect(resolveCallerSite(request)).resolves.toEqual({
-      kind: "refused",
-      reason: "key-required",
-    });
-    expect(db.spoke.findFirst).toHaveBeenCalledTimes(1);
-    expect(db.spoke.findUnique).not.toHaveBeenCalled();
-  });
-
-  it("resolvePublicWorkspace answers it exactly as it answers an unknown key", async () => {
-    const keyless = await resolvePublicWorkspace(requestWith({}).request);
-    const unknown = await resolvePublicWorkspace(
-      requestWith({ "x-ailk-spoke-key": KEY_UNKNOWN }).request,
-    );
-
-    expect(keyless).toEqual({ kind: "unresolved", reason: "spoke-refused" });
-    expect(keyless).toEqual(unknown);
-    expect(db.workspace.count).not.toHaveBeenCalled();
-  });
-});
-
-describe("resolveCallerSite — a deployment with no spoke keeps today's keyless answer (#7633 AC-2)", () => {
-  it("with DATABASE_URL set and an empty registry, is anonymous after exactly one registry read", async () => {
-    emptyRegistry();
-    const { request, warn } = requestWith({});
-
-    await expect(resolveCallerSite(request)).resolves.toEqual({
-      kind: "anonymous",
-    });
-    expect(db.spoke.findFirst).toHaveBeenCalledTimes(1);
-    expect(db.spoke.findUnique).not.toHaveBeenCalled();
-    expect(warn).not.toHaveBeenCalled();
-  });
-
-  it("an unprogrammed read (undefined, the shared mock's default) is read as an empty registry", async () => {
-    db.spoke.findFirst.mockReset();
-    await expect(resolveCallerSite(requestWith({}).request)).resolves.toEqual({
-      kind: "anonymous",
-    });
-  });
-});
-
-describe("resolveCallerSite — the switch and fail-closed reads (#7633 AC-5)", () => {
-  it("mode \"off\" with a non-empty registry is anonymous with zero registry calls", async () => {
-    setMode("off");
-    await expect(resolveCallerSite(requestWith({}).request)).resolves.toEqual({
-      kind: "anonymous",
-    });
-    expect(db.spoke.findFirst).not.toHaveBeenCalled();
-    expect(db.spoke.findUnique).not.toHaveBeenCalled();
-  });
-
-  it("mode \"on\" with an empty registry is refused with zero registry calls", async () => {
-    setMode("on");
-    emptyRegistry();
-    await expect(resolveCallerSite(requestWith({}).request)).resolves.toEqual({
-      kind: "refused",
-      reason: "key-required",
-    });
-    expect(db.spoke.findFirst).not.toHaveBeenCalled();
-    expect(db.spoke.findUnique).not.toHaveBeenCalled();
-  });
-
-  it.each<[string, unknown]>([
-    ["a leftover boolean true", true],
-    ["an unknown string", "yes"],
-  ])("a mode outside the union (%s) refuses, with zero registry calls (NFR5)", async (_label, value) => {
-    emptyRegistry();
-    jest.replaceProperty(configModule, "config", {
-      ...configModule.config,
-      AILK_HUB_REQUIRE_SPOKE_KEY: value as HubSpokeKeyMode,
-    });
-    await expect(resolveCallerSite(requestWith({}).request)).resolves.toEqual({
-      kind: "refused",
-      reason: "key-required",
-    });
-    expect(db.spoke.findFirst).not.toHaveBeenCalled();
-  });
-
-  it("a failed registry read rejects — never anonymous — and is not held: the next call reads again (NFR3)", async () => {
-    db.spoke.findFirst.mockRejectedValueOnce(new Error("connection reset"));
-
-    await expect(resolveCallerSite(requestWith({}).request)).rejects.toThrow(
-      "connection reset",
-    );
-
-    emptyRegistry();
-    await expect(resolveCallerSite(requestWith({}).request)).resolves.toEqual({
-      kind: "anonymous",
-    });
-    expect(db.spoke.findFirst).toHaveBeenCalledTimes(2);
-  });
-});
-
-describe("resolveCallerSite — the held hub answer (#7633 D3, AC-5)", () => {
-  const T0 = 1_800_000_000_000;
-  let now: number;
-
-  beforeEach(() => {
-    now = T0;
-    jest.spyOn(Date, "now").mockImplementation(() => now);
-  });
-
-  async function keyless() {
-    return resolveCallerSite(requestWith({}).request);
-  }
-
-  it("a \"yes\" is held: two keyless calls on a hub make one read, and both are refused", async () => {
-    await expect(keyless()).resolves.toMatchObject({ kind: "refused" });
-    now = T0 + 5_000;
-    await expect(keyless()).resolves.toMatchObject({ kind: "refused" });
-    expect(db.spoke.findFirst).toHaveBeenCalledTimes(1);
-  });
-
-  it("a \"no\" is held for 30 s, then read again; a later \"yes\" is held for good", async () => {
-    emptyRegistry();
-
-    await expect(keyless()).resolves.toEqual({ kind: "anonymous" });
-    now = T0 + 29_999;
-    await expect(keyless()).resolves.toEqual({ kind: "anonymous" });
-    expect(db.spoke.findFirst).toHaveBeenCalledTimes(1);
-
-    // The first registration lands; the held "no" expires.
-    db.spoke.findFirst.mockResolvedValue({ id: S1 } as never);
-    now = T0 + 30_001;
-    await expect(keyless()).resolves.toEqual({
-      kind: "refused",
-      reason: "key-required",
-    });
-    expect(db.spoke.findFirst).toHaveBeenCalledTimes(2);
-
-    // Never reverts in-process, whatever the table later says.
-    emptyRegistry();
-    now = T0 + 10 * 60_000;
-    await expect(keyless()).resolves.toMatchObject({ kind: "refused" });
-    expect(db.spoke.findFirst).toHaveBeenCalledTimes(2);
-  });
-});
-
-describe("resolveCallerSite — a failed hub-status read (#7633 conductor amendment to NFR3: lead capture is never lost)", () => {
-  const T0 = 1_800_000_000_000;
-  let now: number;
-
-  beforeEach(() => {
-    now = T0;
-    jest.spyOn(Date, "now").mockImplementation(() => now);
-  });
-
-  /** A request double whose `log.error` is observable. */
-  function keylessWithLog() {
-    const error = jest.fn();
-    // eslint-disable-next-line no-restricted-syntax -- a FastifyRequest double carrying only the members the resolver reads (headers, log)
-    const request = {
-      headers: {},
-      log: { warn: jest.fn(), info: jest.fn(), error },
-    } as unknown as FastifyRequest;
-    return { request, error };
-  }
-
-  it("(a) with a previous successful \"not a hub\", the held answer is reused on every route, and the failure is logged at error", async () => {
-    emptyRegistry();
-    await expect(resolveCallerSite(requestWith({}).request)).resolves.toEqual({ kind: "anonymous" });
-
-    db.spoke.findFirst.mockRejectedValue(new Error("connection reset"));
-    now = T0 + 30_001;
-    const { request, error } = keylessWithLog();
-    await expect(resolveCallerSite(request)).resolves.toEqual({ kind: "anonymous" });
-    expect(error).toHaveBeenCalledTimes(1);
-    expect(JSON.stringify(error.mock.calls)).not.toContain("connection reset");
-    expect(db.spoke.findFirst).toHaveBeenCalledTimes(2);
-  });
-
-  it("(b) a cold start: a keyless lead write proceeds as on a non-hub, logged at error; every other caller still rejects", async () => {
-    db.spoke.findFirst.mockRejectedValue(new Error("connection reset"));
-
-    const lead = keylessWithLog();
-    await expect(
-      resolveCallerSite(lead.request, { keylessOnRegistryFailure: "anonymous" }),
-    ).resolves.toEqual({ kind: "anonymous" });
-    expect(lead.error).toHaveBeenCalledTimes(1);
-
-    // Nothing is held: a content read or schedule call still rejects.
-    await expect(resolveCallerSite(requestWith({}).request)).rejects.toThrow("connection reset");
-    await expect(resolvePublicWorkspace(requestWith({}).request)).rejects.toThrow("connection reset");
-  });
-
-  it("(b) a call that carries a key is unchanged under the lead-write option — an unknown key is refused", async () => {
-    db.spoke.findFirst.mockRejectedValue(new Error("connection reset"));
-    const { request } = requestWith({ "x-ailk-spoke-key": KEY_UNKNOWN });
-    await expect(
-      resolveCallerSite(request, { keylessOnRegistryFailure: "anonymous" }),
-    ).resolves.toEqual({ kind: "refused", reason: "key-unknown" });
-    expect(db.spoke.findFirst).not.toHaveBeenCalled();
-  });
-
-  it("(c) a process that has seen a hub keeps refusing keyless calls through an outage — on a lead write too", async () => {
-    await expect(resolveCallerSite(requestWith({}).request)).resolves.toMatchObject({ kind: "refused" });
-
-    db.spoke.findFirst.mockRejectedValue(new Error("connection reset"));
-    now = T0 + 10 * 60_000;
-    await expect(
-      resolveCallerSite(requestWith({}).request, { keylessOnRegistryFailure: "anonymous" }),
-    ).resolves.toEqual({ kind: "refused", reason: "key-required" });
-    await expect(resolveCallerSite(requestWith({}).request)).resolves.toEqual({
-      kind: "refused",
-      reason: "key-required",
-    });
-    expect(db.spoke.findFirst).toHaveBeenCalledTimes(1);
-  });
-});