create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/lib/__tests__/consent-store.test.ts

@@ -1,353 +0,0 @@
-/**
- * @file consent-store.test.ts
- * @description The consent ledger's read boundary (#8438 D4, AC-2).
- *
- * External dependency boundaries mocked:
- *   - @working-theory/database (via moduleNameMapper -> prisma-client.js mock;
- *     prisma singleton via __mocks__/prisma.ts)
- *
- * The readers run over `consent-ledger-double.ts`, an in-memory model with
- * the same semantics as their SQL; the SQL text itself is run against a real
- * database by `database/__tests__/consent-ledger.db.test.ts`. What this file
- * proves: the two readings never mix (a row an anonymous writer attached to a
- * Person never changes the Person's OWN answer), a flood cannot push an
- * answer out, history pages are complete, and a cursor of another Person is
- * refused.
- */
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../prisma.js");
-
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-
-import { siteConsentConfigSchema } from "@working-theory/validation";
-
-import {
-  CONSENT_HISTORY_PAGE_SIZE,
-  anySourceConsentState,
-  effectiveConsent,
-  isUnverifiedSource,
-  latestVisitorChoice,
-  OWN_CONSENT_SOURCES,
-  ownConsentState,
-  personConsentHistory,
-  userPlatformRows,
-} from "../consent-store.js";
-import { prisma } from "../prisma.js";
-
-import {
-  armConsentLedger,
-  type ConsentLedgerDouble,
-  type LedgerRow,
-} from "./consent-ledger-double.js";
-
-const WS = "wksp_01920000-0000-7000-8000-0000000000a1";
-const OTHER_WS = "wksp_01920000-0000-7000-8000-0000000000a2";
-const PERSON = "person_01920000-0000-7000-8000-0000000000a1";
-const OTHER_PERSON = "person_01920000-0000-7000-8000-0000000000a2";
-const VISITOR = "0192a000-0000-4000-8000-0000000000a1";
-
-const CONFIG = siteConsentConfigSchema.parse({
-  policies: {},
-  purposes: [
-    {
-      id: "news",
-      kind: "preference",
-      area: "communications",
-      label: { en: "News." },
-    },
-    { id: "data", kind: "consent", area: "data", label: { en: "Data." } },
-  ],
-});
-
-let double: ConsentLedgerDouble;
-let counter = 0;
-
-function row(over: Partial<LedgerRow>): LedgerRow {
-  counter += 1;
-  return {
-    id: `cnsnt_00000000-0000-7000-8000-${String(900000 + counter).padStart(12, "0")}`,
-    workspaceId: WS,
-    subjectType: "person",
-    subjectId: PERSON,
-    personId: PERSON,
-    purposeId: "news",
-    granted: true,
-    source: "account_settings",
-    sourceRef: null,
-    policyVersion: 1,
-    locale: "en",
-    statement: "News.",
-    createdAt: new Date(Date.UTC(2026, 9, 12, 0, 0, 0, counter)),
-    ...over,
-  };
-}
-
-beforeEach(() => {
-  jest.clearAllMocks();
-  counter = 0;
-  double = armConsentLedger(prisma);
-});
-
-describe("the two readings (SEC-8438-1)", () => {
-  it("a magnet grant an anonymous form attached never changes the Person's OWN answer", async () => {
-    double.ledger.push(
-      row({ purposeId: "data", granted: false, source: "account_settings" }),
-      row({
-        purposeId: "data",
-        granted: true,
-        source: "magnet",
-        sourceRef: "guide",
-      }),
-    );
-    const own = await ownConsentState(WS, PERSON, CONFIG);
-    const any = await anySourceConsentState(WS, PERSON, CONFIG);
-    expect(own.find((s) => s.purposeId === "data")?.effective).toBe(false);
-    expect(any.find((s) => s.purposeId === "data")?.effective).toBe(true);
-    expect(any.find((s) => s.purposeId === "data")?.row?.source).toBe("magnet");
-  });
-
-  it("a preference is on until withdrawn, a consent off until granted, with no row", async () => {
-    const own = await ownConsentState(WS, PERSON, CONFIG);
-    expect(own.map((s) => [s.purposeId, s.kind, s.row, s.effective])).toEqual([
-      ["news", "preference", null, true],
-      ["data", "consent", null, false],
-    ]);
-    expect(effectiveConsent("preference", null)).toBe(true);
-    expect(effectiveConsent("agreement", null)).toBe(false);
-    expect(effectiveConsent("consent", { granted: false })).toBe(false);
-  });
-
-  it("the OWN sources are exactly the three the SQL names, and the unverified set is the rest", () => {
-    const source = readFileSync(join(__dirname, "../consent-store.ts"), "utf8");
-    const literal = `IN ('${OWN_CONSENT_SOURCES.join("', '")}')`;
-    expect(source.split(literal).length - 1).toBe(1);
-    expect(OWN_CONSENT_SOURCES.map(isUnverifiedSource)).toEqual([
-      false,
-      false,
-      false,
-    ]);
-    expect(
-      (["magnet", "api", "cookie_banner", "legacy"] as const).every(
-        isUnverifiedSource,
-      ),
-    ).toBe(true);
-  });
-
-  it("a checkout row is unverified: in the Person's any-source reading, never their own (#8765 D13, C10)", async () => {
-    expect(isUnverifiedSource("checkout")).toBe(true);
-    double.ledger.push(
-      row({
-        purposeId: "data",
-        granted: true,
-        source: "checkout",
-        sourceRef: "cs_live_abc123",
-      }),
-    );
-    const own = await ownConsentState(WS, PERSON, CONFIG);
-    const any = await anySourceConsentState(WS, PERSON, CONFIG);
-    expect(own.find((s) => s.purposeId === "data")?.row).toBeNull();
-    expect(any.find((s) => s.purposeId === "data")?.row).toMatchObject({
-      source: "checkout",
-      sourceRef: "cs_live_abc123",
-    });
-  });
-
-  it("another workspace's rows and another Person's rows never show", async () => {
-    double.ledger.push(
-      row({ workspaceId: OTHER_WS, purposeId: "data", granted: true }),
-      row({
-        personId: OTHER_PERSON,
-        subjectId: OTHER_PERSON,
-        purposeId: "data",
-        granted: true,
-      }),
-    );
-    const own = await ownConsentState(WS, PERSON, CONFIG);
-    expect(own.find((s) => s.purposeId === "data")?.row).toBeNull();
-  });
-
-  it("a linked visitor's cookie rows reach the any-source reading only, and only in the same workspace", async () => {
-    double.ledger.push(
-      row({
-        subjectType: "visitor",
-        subjectId: VISITOR,
-        personId: null,
-        purposeId: "data",
-        granted: true,
-        source: "cookie_banner",
-      }),
-    );
-    double.links.push({
-      workspaceId: WS,
-      visitorId: VISITOR,
-      personId: PERSON,
-      source: "magnet",
-    });
-    double.links.push({
-      workspaceId: OTHER_WS,
-      visitorId: VISITOR,
-      personId: OTHER_PERSON,
-      source: "magnet",
-    });
-    const any = await anySourceConsentState(WS, PERSON, CONFIG);
-    expect(any.find((s) => s.purposeId === "data")?.row?.source).toBe(
-      "cookie_banner",
-    );
-    expect(
-      (await anySourceConsentState(WS, OTHER_PERSON, CONFIG)).every(
-        (s) => s.row === null,
-      ),
-    ).toBe(true);
-    expect(
-      (await ownConsentState(WS, PERSON, CONFIG)).every((s) => s.row === null),
-    ).toBe(true);
-  });
-});
-
-describe("the flood case (SEC-8438-2, AC-2)", () => {
-  it("600 magnet grants and 600 linked-visitor cookie rows cannot push out a withdrawal", async () => {
-    double.ledger.push(
-      row({ purposeId: "data", granted: false, source: "account_settings" }),
-    );
-    double.links.push({
-      workspaceId: WS,
-      visitorId: VISITOR,
-      personId: PERSON,
-      source: "magnet",
-    });
-    for (let i = 0; i < 600; i += 1) {
-      double.ledger.push(
-        row({ purposeId: "data", granted: true, source: "magnet" }),
-      );
-    }
-    for (let i = 0; i < 600; i += 1) {
-      double.ledger.push(
-        row({
-          subjectType: "visitor",
-          subjectId: VISITOR,
-          personId: null,
-          purposeId: "data",
-          granted: true,
-          source: "cookie_banner",
-        }),
-      );
-    }
-    const own = await ownConsentState(WS, PERSON, CONFIG);
-    const any = await anySourceConsentState(WS, PERSON, CONFIG);
-    expect(own.find((s) => s.purposeId === "data")).toMatchObject({
-      effective: false,
-    });
-    expect(any.find((s) => s.purposeId === "data")).toMatchObject({
-      effective: true,
-    });
-
-    // Following nextCursor returns all 1,201 rows exactly once.
-    const seen: string[] = [];
-    let cursor: string | undefined;
-    let pages = 0;
-    for (;;) {
-      const page = await personConsentHistory(WS, PERSON, cursor);
-      if (page === "invalid_cursor")
-        throw new Error("unexpected invalid cursor");
-      expect(page.rows.length).toBeLessThanOrEqual(CONSENT_HISTORY_PAGE_SIZE);
-      seen.push(...page.rows.map((r) => r.id));
-      pages += 1;
-      if (page.nextCursor === null) break;
-      cursor = page.nextCursor;
-    }
-    expect(pages).toBe(3);
-    expect(seen).toHaveLength(1201);
-    expect(new Set(seen).size).toBe(1201);
-  });
-});
-
-describe("personConsentHistory", () => {
-  it("is newest first and carries the wording, never a subject id", async () => {
-    double.ledger.push(row({ granted: true }), row({ granted: false }));
-    const page = await personConsentHistory(WS, PERSON, undefined);
-    if (page === "invalid_cursor") throw new Error("unexpected");
-    expect(page.rows.map((r) => r.granted)).toEqual([false, true]);
-    expect(page.rows[0]).toHaveProperty("statement", "News.");
-    expect(page.rows[0]).not.toHaveProperty("subjectId");
-    expect(page.nextCursor).toBeNull();
-  });
-
-  it("refuses a cursor that is another Person's row, another workspace's row, or unknown", async () => {
-    double.ledger.push(
-      row({ granted: true }),
-      row({ personId: OTHER_PERSON, subjectId: OTHER_PERSON }),
-      row({ workspaceId: OTHER_WS }),
-    );
-    const [, theirs, elsewhere] = double.ledger;
-    expect(await personConsentHistory(WS, PERSON, theirs!.id)).toBe(
-      "invalid_cursor",
-    );
-    expect(await personConsentHistory(WS, PERSON, elsewhere!.id)).toBe(
-      "invalid_cursor",
-    );
-    expect(await personConsentHistory(WS, PERSON, "cnsnt_nope")).toBe(
-      "invalid_cursor",
-    );
-  });
-});
-
-describe("the cookie dedupe read and the platform read", () => {
-  it("latestVisitorChoice answers the newest row for the visitor and purpose", async () => {
-    double.ledger.push(
-      row({
-        subjectType: "visitor",
-        subjectId: VISITOR,
-        personId: null,
-        granted: true,
-        purposeId: "data",
-        source: "cookie_banner",
-      }),
-      row({
-        subjectType: "visitor",
-        subjectId: VISITOR,
-        personId: null,
-        granted: false,
-        purposeId: "data",
-        source: "cookie_banner",
-      }),
-    );
-    expect(await latestVisitorChoice(WS, VISITOR, "data")).toEqual({
-      granted: false,
-      policyVersion: 1,
-    });
-    expect(await latestVisitorChoice(WS, VISITOR, "news")).toBeNull();
-    expect(await latestVisitorChoice(OTHER_WS, VISITOR, "data")).toBeNull();
-  });
-
-  it("userPlatformRows reads the user's own rows, newest per purpose", async () => {
-    double.ledger.push(
-      row({
-        subjectType: "user",
-        subjectId: "user_1",
-        personId: null,
-        purposeId: "wt_marketing",
-        granted: true,
-      }),
-      row({
-        subjectType: "user",
-        subjectId: "user_1",
-        personId: null,
-        purposeId: "wt_marketing",
-        granted: false,
-      }),
-      row({
-        subjectType: "user",
-        subjectId: "user_2",
-        personId: null,
-        purposeId: "wt_marketing",
-        granted: true,
-      }),
-    );
-    const rows = await userPlatformRows(WS, "user_1");
-    expect(rows.map((r) => [r.purposeId, r.granted])).toEqual([
-      ["wt_marketing", false],
-    ]);
-  });
-});

package/templates/apps/api/src/lib/__tests__/content-adapter.test.ts

@@ -1,201 +0,0 @@
-/**
- * Tests for apps/api/src/lib/content-adapter.ts factory.
- *
- * Covers:
- *   (a) CONTENT_ADAPTER unset → MDX adapter (existing behavior preserved)
- *   (b) CONTENT_ADAPTER=projection + valid manifest → projection adapter, read parity vs MDX
- *   (c) CONTENT_ADAPTER=projection + missing manifest → clear actionable error at construction
- *   (d) CONTENT_ADAPTER=database with no workspaceId → the resolver's named error
- *   (e) CONTENT_ADAPTER=database with a workspaceId → an adapter, not a throw (#5852)
- */
-import { join, resolve } from "node:path";
-import { mkdirSync, writeFileSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-
-import { DEFAULT_WORKSPACE_ID } from "@working-theory/database/tenancy";
-
-import {
-  getContentAdapter,
-  getContentRoot,
-  resetContentAdapter,
-} from "../content-adapter.js";
-
-// Local fixture: a minimal content root with one HomePage page.
-const FIXTURE_ROOT = resolve(__dirname, "fixtures");
-
-// The matching manifest for the local fixture.
-const FIXTURE_MANIFEST =
-  JSON.stringify(
-    {
-      HomePage: [
-        {
-          type: "HomePage",
-          slug: "home",
-          title: "AI Launch Kit",
-          description:
-            "AX-first OSS template for shipping software with API and MCP.",
-        },
-      ],
-    },
-    null,
-    2,
-  ) + "\n";
-
-describe("getContentAdapter() factory", () => {
-  const savedEnv: Record<string, string | undefined> = {};
-
-  beforeEach(() => {
-    savedEnv.CONTENT_ADAPTER = process.env.CONTENT_ADAPTER;
-    savedEnv.CONTENT_ROOT = process.env.CONTENT_ROOT;
-    savedEnv.MANIFEST_PATH = process.env.MANIFEST_PATH;
-    resetContentAdapter();
-  });
-
-  afterEach(() => {
-    if (savedEnv.CONTENT_ADAPTER === undefined) {
-      delete process.env.CONTENT_ADAPTER;
-    } else {
-      process.env.CONTENT_ADAPTER = savedEnv.CONTENT_ADAPTER;
-    }
-    if (savedEnv.CONTENT_ROOT === undefined) {
-      delete process.env.CONTENT_ROOT;
-    } else {
-      process.env.CONTENT_ROOT = savedEnv.CONTENT_ROOT;
-    }
-    if (savedEnv.MANIFEST_PATH === undefined) {
-      delete process.env.MANIFEST_PATH;
-    } else {
-      process.env.MANIFEST_PATH = savedEnv.MANIFEST_PATH;
-    }
-    resetContentAdapter();
-  });
-
-  describe("(a) CONTENT_ADAPTER unset → MDX adapter", () => {
-    test("returns an adapter that reads fixture pages via MDX", async () => {
-      delete process.env.CONTENT_ADAPTER;
-      process.env.CONTENT_ROOT = FIXTURE_ROOT;
-
-      const adapter = getContentAdapter();
-      expect(adapter).toBeDefined();
-      const page = await adapter.getPageBySlug("HomePage", "home");
-      expect(page).not.toBeNull();
-      expect(page?.title).toBe("AI Launch Kit");
-    });
-  });
-
-  describe("(b) CONTENT_ADAPTER=projection + valid manifest → projection adapter", () => {
-    let tmpDir: string;
-    let manifestPath: string;
-
-    beforeEach(() => {
-      tmpDir = join(tmpdir(), `ailk-adapter-test-${Date.now()}`);
-      mkdirSync(tmpDir, { recursive: true });
-      manifestPath = join(tmpDir, "manifest.json");
-      writeFileSync(manifestPath, FIXTURE_MANIFEST, "utf8");
-    });
-
-    afterEach(() => {
-      rmSync(tmpDir, { recursive: true, force: true });
-    });
-
-    test("returns projection adapter when CONTENT_ADAPTER=projection", async () => {
-      process.env.CONTENT_ADAPTER = "projection";
-      process.env.MANIFEST_PATH = manifestPath;
-
-      const adapter = getContentAdapter();
-      const page = await adapter.getPageBySlug("HomePage", "home");
-      expect(page).not.toBeNull();
-      expect(page?.title).toBe("AI Launch Kit");
-    });
-
-    test("read parity: projection adapter listPages matches MDX adapter against same fixture", async () => {
-      // MDX adapter against local fixture
-      delete process.env.CONTENT_ADAPTER;
-      process.env.CONTENT_ROOT = FIXTURE_ROOT;
-      const mdxAdapter = getContentAdapter();
-      const mdxPages = await mdxAdapter.listPages("HomePage");
-      resetContentAdapter();
-
-      // Projection adapter backed by manifest matching same fixture
-      process.env.CONTENT_ADAPTER = "projection";
-      process.env.MANIFEST_PATH = manifestPath;
-      const projAdapter = getContentAdapter();
-      const projPages = await projAdapter.listPages("HomePage");
-
-      const sortBySlug = (a: { slug: string }, b: { slug: string }) =>
-        a.slug.localeCompare(b.slug);
-      expect(projPages.sort(sortBySlug)).toEqual(mdxPages.sort(sortBySlug));
-    });
-
-    test("projection adapter write methods throw read-only error", async () => {
-      process.env.CONTENT_ADAPTER = "projection";
-      process.env.MANIFEST_PATH = manifestPath;
-
-      const adapter = getContentAdapter();
-      await expect(
-        adapter.createPage("HomePage", "new", {
-          type: "HomePage",
-          slug: "new",
-          title: "New",
-          description: "Desc",
-          body: "body",
-        }),
-      ).rejects.toThrow("read-only");
-    });
-  });
-
-  describe("(c) CONTENT_ADAPTER=projection + missing manifest → clear actionable error", () => {
-    test("throws at getContentAdapter() call time naming the missing path and instructing compile step", () => {
-      process.env.CONTENT_ADAPTER = "projection";
-      process.env.MANIFEST_PATH = "/nonexistent/path/manifest.json";
-
-      expect(() => getContentAdapter()).toThrow(
-        "/nonexistent/path/manifest.json",
-      );
-      expect(() => getContentAdapter()).toThrow("pnpm content:compile");
-    });
-  });
-
-  describe("(d) CONTENT_ADAPTER=database → the resolver's workspaceId error", () => {
-    test("throws naming workspaceId, because apps/api does not resolve a tenant yet (#5323)", () => {
-      process.env.CONTENT_ADAPTER = "database";
-
-      expect(() => getContentAdapter()).toThrow(/workspaceId/);
-      expect(() => getContentAdapter()).toThrow(/CONTENT_ADAPTER=database/);
-    });
-  });
-
-  describe("(e) CONTENT_ADAPTER=database + a workspaceId → an adapter (#5852)", () => {
-    test("builds the database adapter instead of throwing, once the caller resolves a tenant", () => {
-      process.env.CONTENT_ADAPTER = "database";
-
-      const adapter = getContentAdapter({ workspaceId: DEFAULT_WORKSPACE_ID });
-      expect(adapter).toBeDefined();
-      expect(typeof adapter.getPageBySlug).toBe("function");
-    });
-  });
-});
-
-describe("getContentRoot()", () => {
-  const savedContentRoot = process.env.CONTENT_ROOT;
-
-  afterEach(() => {
-    if (savedContentRoot === undefined) {
-      delete process.env.CONTENT_ROOT;
-    } else {
-      process.env.CONTENT_ROOT = savedContentRoot;
-    }
-  });
-
-  test("returns CONTENT_ROOT env when set", () => {
-    process.env.CONTENT_ROOT = "/explicit/content/root";
-    expect(getContentRoot()).toBe("/explicit/content/root");
-  });
-
-  test("returns a string path when env is unset", () => {
-    delete process.env.CONTENT_ROOT;
-    const root = getContentRoot();
-    expect(typeof root).toBe("string");
-    expect(root.length).toBeGreaterThan(0);
-  });
-});