create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/lib/__tests__/deliverable-asset-store.test.ts

@@ -1,224 +0,0 @@
-/**
- * @file deliverable-asset-store.test.ts
- * @description Unit tests for the deliverable-asset-store boundary (#6310
- * D16) — the two scoped `Asset` reads a magnet deliverable resolution and
- * its serve path need, modelled on `lib/asset-store.ts`'s own test shape.
- */
-
-// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock (Jest requires explicit call for local files)
-jest.mock("../prisma.js");
-
-import { prisma } from "../prisma.js";
-import {
-  findDeliverableAssetIdByKey,
-  readDeliverableAsset,
-} from "../deliverable-asset-store";
-
-const WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000001";
-const OTHER_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000002";
-const ASSET_ID = "asset_00000000-0000-7000-8000-0000000000a1";
-
-describe("findDeliverableAssetIdByKey", () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-    (prisma.interaction.count as jest.Mock).mockResolvedValue(0);
-  });
-
-  it("queries with exactly { workspaceId, key }", async () => {
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({ id: ASSET_ID, tags: [] });
-
-    const result = await findDeliverableAssetIdByKey(WORKSPACE_ID, "q3-report.pdf");
-
-    expect(prisma.asset.findFirst).toHaveBeenCalledWith({
-      where: { workspaceId: WORKSPACE_ID, key: "q3-report.pdf" },
-      select: { id: true, tags: true },
-    });
-    expect(result).toBe(ASSET_ID);
-  });
-
-  // SEC-7877-A: a client file is never a magnet deliverable — a `private` key
-  // resolves to nothing, the same as a miss (#7877 security review SR-7877-1).
-  it("returns null for a private-tagged asset", async () => {
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({
-      id: ASSET_ID,
-      tags: ["private"],
-    });
-
-    const result = await findDeliverableAssetIdByKey(WORKSPACE_ID, "member/scan.pdf");
-
-    expect(result).toBeNull();
-  });
-
-  it("returns null for an asset a message attaches", async () => {
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({ id: ASSET_ID, tags: [] });
-    (prisma.interaction.count as jest.Mock).mockResolvedValue(1);
-
-    const result = await findDeliverableAssetIdByKey(WORKSPACE_ID, "member/scan.pdf");
-
-    expect(prisma.interaction.count).toHaveBeenCalledWith({
-      where: { assetId: ASSET_ID, workspaceId: WORKSPACE_ID },
-    });
-    expect(result).toBeNull();
-  });
-
-  it("does not return a same-key row scoped to a different workspace", async () => {
-    // The mock proves the CALL is scoped correctly; a real DB enforces the
-    // rest. This asserts the where-clause never widens to a foreign
-    // workspace even when one exists.
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
-
-    const result = await findDeliverableAssetIdByKey(
-      OTHER_WORKSPACE_ID,
-      "q3-report.pdf",
-    );
-
-    expect(prisma.asset.findFirst).toHaveBeenCalledWith({
-      where: { workspaceId: OTHER_WORKSPACE_ID, key: "q3-report.pdf" },
-      select: { id: true, tags: true },
-    });
-    expect(result).toBeNull();
-  });
-
-  it("returns null on a miss", async () => {
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
-
-    const result = await findDeliverableAssetIdByKey(WORKSPACE_ID, "no-such-key");
-
-    expect(result).toBeNull();
-  });
-});
-
-describe("readDeliverableAsset", () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-    (prisma.interaction.count as jest.Mock).mockResolvedValue(0);
-  });
-
-  it("queries with exactly { id, workspaceId } and selects filename/contentType/bytes", async () => {
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({
-      filename: "q3-report.pdf",
-      contentType: "application/pdf",
-      bytes: Buffer.from("PDF-BYTES"),
-      tags: [],
-    });
-
-    const result = await readDeliverableAsset(ASSET_ID, WORKSPACE_ID);
-
-    expect(prisma.asset.findFirst).toHaveBeenCalledWith({
-      where: { id: ASSET_ID, workspaceId: WORKSPACE_ID },
-      select: { filename: true, contentType: true, bytes: true, tags: true },
-    });
-    expect(result).toEqual({
-      filename: "q3-report.pdf",
-      contentType: "application/pdf",
-      bytes: expect.any(Buffer),
-    });
-  });
-
-  it("returns null for a foreign-workspace id (the scoped read excludes it)", async () => {
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
-
-    const result = await readDeliverableAsset(ASSET_ID, OTHER_WORKSPACE_ID);
-
-    expect(result).toBeNull();
-  });
-
-  // SEC-7877-A: a grant minted before the asset became a client file still
-  // never serves it (#7877 security review SR-7877-1).
-  it("returns null for a private-tagged asset", async () => {
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({
-      filename: "scan.pdf",
-      contentType: "application/pdf",
-      bytes: Buffer.from("PDF-BYTES"),
-      tags: ["private"],
-    });
-
-    const result = await readDeliverableAsset(ASSET_ID, WORKSPACE_ID);
-
-    expect(result).toBeNull();
-  });
-
-  it("returns null for an asset a message attaches", async () => {
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({
-      filename: "scan.pdf",
-      contentType: "application/pdf",
-      bytes: Buffer.from("PDF-BYTES"),
-      tags: [],
-    });
-    (prisma.interaction.count as jest.Mock).mockResolvedValue(1);
-
-    const result = await readDeliverableAsset(ASSET_ID, WORKSPACE_ID);
-
-    expect(prisma.interaction.count).toHaveBeenCalledWith({
-      where: { assetId: ASSET_ID, workspaceId: WORKSPACE_ID },
-    });
-    expect(result).toBeNull();
-  });
-
-  it("wraps the returned bytes as a Buffer view, not a copy", async () => {
-    const raw = new Uint8Array([1, 2, 3, 4]);
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({
-      filename: "f.pdf",
-      contentType: "application/pdf",
-      bytes: raw,
-      tags: [],
-    });
-
-    const result = await readDeliverableAsset(ASSET_ID, WORKSPACE_ID);
-
-    expect(Buffer.isBuffer(result?.bytes)).toBe(true);
-    expect(result?.bytes.byteOffset).toBe(raw.byteOffset);
-    expect(result?.bytes.buffer).toBe(raw.buffer);
-  });
-});
-
-describe("module boundary contract (§1.14 / D16)", () => {
-  it("exports no write, no findMany and no unscoped read", () => {
-    // The boundary's entire contract is "two named functions, nothing else
-    // reads prisma.asset" — asserted at the module surface so a future edit
-    // adding a third export or a raw prisma re-export fails this test.
-     
-    const mod = require("../deliverable-asset-store");
-    expect(Object.keys(mod).sort()).toEqual(
-      ["findDeliverableAssetIdByKey", "readDeliverableAsset"].sort(),
-    );
-  });
-});
-
-// #8171 D3 (AC-6): a delivered version's file is never a magnet deliverable —
-// untagged, attached to no message, and still `null` from both reads.
-describe("a delivered version's file (#8171 D3)", () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-    (prisma.interaction.count as jest.Mock).mockResolvedValue(0);
-  });
-
-  it("findDeliverableAssetIdByKey returns null, counting within the workspace", async () => {
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({ id: ASSET_ID, tags: [] });
-    (prisma.pieceVersion.count as jest.Mock).mockResolvedValueOnce(1);
-
-    const result = await findDeliverableAssetIdByKey(WORKSPACE_ID, "draft-2.pdf");
-
-    expect(prisma.pieceVersion.count).toHaveBeenCalledWith({
-      where: { assetId: ASSET_ID, workspaceId: WORKSPACE_ID },
-    });
-    expect(result).toBeNull();
-  });
-
-  it("readDeliverableAsset returns null, counting within the workspace", async () => {
-    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({
-      filename: "draft-2.pdf",
-      contentType: "application/pdf",
-      bytes: new Uint8Array([1, 2, 3]),
-      tags: [],
-    });
-    (prisma.pieceVersion.count as jest.Mock).mockResolvedValueOnce(1);
-
-    const result = await readDeliverableAsset(ASSET_ID, WORKSPACE_ID);
-
-    expect(prisma.pieceVersion.count).toHaveBeenCalledWith({
-      where: { assetId: ASSET_ID, workspaceId: WORKSPACE_ID },
-    });
-    expect(result).toBeNull();
-  });
-});

package/templates/apps/api/src/lib/__tests__/error-serializer.test.ts

@@ -1,120 +0,0 @@
-/**
- * error-serializer — Fastify error handler that prevents internal-error leaks.
- *
- * Internal exceptions (DB errors, third-party SDK errors, unhandled throws)
- * must NOT echo their `.message` or stack trace to the client. Clients see a
- * generic `internal_error`; the full detail goes to pino at error level.
- *
- * Validation errors (Fastify's built-in 400 with FST_ERR_VALIDATION) keep
- * their structured detail because schemas are safe to surface.
- *
- * Explicitly-set HTTP statuses (`reply.code(404).send(...)`) flow through
- * untouched.
- */
-import Fastify, { type FastifyInstance } from "fastify";
-
-import { registerErrorSerializer } from "../error-serializer.js";
-
-describe("error-serializer", () => {
-  let server: FastifyInstance;
-  const logLines: Array<Record<string, unknown>> = [];
-
-  beforeEach(async () => {
-    logLines.length = 0;
-    server = Fastify({
-      logger: {
-        level: "error",
-        stream: {
-          write(msg: string) {
-            logLines.push(JSON.parse(msg) as Record<string, unknown>);
-          },
-        },
-      },
-    });
-
-    registerErrorSerializer(server);
-
-    server.get("/boom", async () => {
-      throw new Error(
-        "internal-detail: connection refused at db host secret.host.internal:5432",
-      );
-    });
-
-    server.get("/explicit-400", async (_req, reply) => {
-      await reply.code(400).send({ error: "validation-error" });
-    });
-
-    server.get("/explicit-404", async (_req, reply) => {
-      await reply.code(404).send({ error: "not-found" });
-    });
-
-    await server.ready();
-  });
-
-  afterEach(async () => {
-    await server.close();
-  });
-
-  it("returns generic internal_error on uncaught throw — no detail in body", async () => {
-    const response = await server.inject({ method: "GET", url: "/boom" });
-
-    expect(response.statusCode).toBe(500);
-    const body = JSON.parse(response.body) as Record<string, unknown>;
-    expect(body).toEqual({ error: "internal_error" });
-    expect(JSON.stringify(body)).not.toContain("connection refused");
-    expect(JSON.stringify(body)).not.toContain("secret.host.internal");
-    expect(JSON.stringify(body)).not.toContain("stack");
-  });
-
-  it("logs full error detail to pino at error level", async () => {
-    await server.inject({ method: "GET", url: "/boom" });
-
-    const text = JSON.stringify(logLines);
-    expect(text).toContain("connection refused");
-  });
-
-  it("does NOT include stack traces in response body", async () => {
-    const response = await server.inject({ method: "GET", url: "/boom" });
-
-    expect(response.body).not.toMatch(/at\s+\w+\s+\(/); // typical stack frame
-    expect(response.body).not.toContain("Error:");
-  });
-
-  it("leaves explicit 4xx replies untouched", async () => {
-    const r400 = await server.inject({ method: "GET", url: "/explicit-400" });
-    expect(r400.statusCode).toBe(400);
-    expect(JSON.parse(r400.body)).toEqual({ error: "validation-error" });
-
-    const r404 = await server.inject({ method: "GET", url: "/explicit-404" });
-    expect(r404.statusCode).toBe(404);
-    expect(JSON.parse(r404.body)).toEqual({ error: "not-found" });
-  });
-
-  it("doesn't leak the Error.message via the default 'message' field", async () => {
-    const response = await server.inject({ method: "GET", url: "/boom" });
-    const body = JSON.parse(response.body) as Record<string, unknown>;
-
-    expect(body["message"]).toBeUndefined();
-    expect(body["statusCode"]).toBeUndefined();
-  });
-
-  // #6019 AC-2 — `pathWithoutQuery` (#5970 security review, finding 1): a
-  // route may carry its credential in the query string
-  // (`/v1/requests/:id/confirm?token=…` does), and this handler logs `path`
-  // on EVERY 5xx. A future refactor restoring the raw `request.url` must turn
-  // this red.
-  it("scrubs a query-string credential from the logged path on a 5xx", async () => {
-    await server.inject({
-      method: "GET",
-      url: "/boom?token=SUPERSECRETTOKEN",
-    });
-
-    const logged = logLines.find(
-      (line) => line["msg"] === "internal server error",
-    );
-    expect(logged?.["path"]).toBe("/boom");
-    const text = JSON.stringify(logLines);
-    expect(text).not.toContain("SUPERSECRETTOKEN");
-    expect(text).not.toContain("token=");
-  });
-});

package/templates/apps/api/src/lib/__tests__/errors.test.ts

@@ -1,94 +0,0 @@
-/**
- * Unit tests for the canonical error helpers used by D14a content-write
- * routes. Asserts each helper returns the right status + canonical body shape
- * with the correct machine code.
- */
-
-import {
-  conflictError,
-  notFoundError,
-  paymentRequiredError,
-  unauthorizedError,
-  validationError,
-} from "../errors.js";
-
-describe("apps/api/lib/errors", () => {
-  describe("validationError", () => {
-    it("returns status 400 with validation_failed code", () => {
-      const err = validationError("Invalid input");
-      expect(err.status).toBe(400);
-      expect(err.body).toEqual({
-        error: "validation_failed",
-        message: "Invalid input",
-      });
-    });
-
-    it("includes details when provided", () => {
-      const err = validationError("Invalid type or slug", {
-        field: "type",
-        received: "Unknown",
-      });
-      expect(err.body).toEqual({
-        error: "validation_failed",
-        message: "Invalid type or slug",
-        details: { field: "type", received: "Unknown" },
-      });
-    });
-
-    it("omits details key entirely when not provided", () => {
-      const err = validationError("Bad input");
-      expect("details" in err.body).toBe(false);
-    });
-  });
-
-  describe("unauthorizedError", () => {
-    it("returns status 401 with unauthorized code", () => {
-      const err = unauthorizedError("Missing or invalid token");
-      expect(err.status).toBe(401);
-      expect(err.body).toEqual({
-        error: "unauthorized",
-        message: "Missing or invalid token",
-      });
-    });
-  });
-
-  describe("paymentRequiredError", () => {
-    it("returns status 402 with payment_required code", () => {
-      const err = paymentRequiredError("Pro license required");
-      expect(err.status).toBe(402);
-      expect(err.body).toEqual({
-        error: "payment_required",
-        message: "Pro license required",
-      });
-    });
-  });
-
-  describe("notFoundError", () => {
-    it("returns status 404 with not_found code", () => {
-      const err = notFoundError("Page not found");
-      expect(err.status).toBe(404);
-      expect(err.body).toEqual({
-        error: "not_found",
-        message: "Page not found",
-      });
-    });
-  });
-
-  describe("conflictError", () => {
-    it("returns status 409 with conflict code", () => {
-      const err = conflictError("Stale version token");
-      expect(err.status).toBe(409);
-      expect(err.body).toEqual({
-        error: "conflict",
-        message: "Stale version token",
-      });
-    });
-
-    it("includes details (e.g. existing version) when provided", () => {
-      const err = conflictError("Slug already exists", {
-        existingVersion: "abc123",
-      });
-      expect(err.body.details).toEqual({ existingVersion: "abc123" });
-    });
-  });
-});

package/templates/apps/api/src/lib/__tests__/file-fallback.test.ts

@@ -1,144 +0,0 @@
-/**
- * @file file-fallback.test.ts
- * @description Unit tests for file-fallback.ts — writeLeadFallback
- *
- * Test path deviation from spec §3: spec states apps/api/__tests__/lib/,
- * but jest.config.cjs roots at <rootDir>/src, so tests live at
- * apps/api/src/lib/__tests__/ to match the existing repo convention.
- */
-
-import * as fs from "fs/promises";
-import * as os from "os";
-import * as path from "path";
-
-import { writeLeadFallback } from "../file-fallback.js";
-import type { FallbackLead } from "../file-fallback.js";
-
-function makeLead(overrides: Partial<FallbackLead> = {}): FallbackLead {
-  return {
-    id: "abc123de",
-    siteId: "site-001",
-    source: "oss-form",
-    email: "test@example.com",
-    payload: { message: "hello" },
-    createdAt: "2026-05-08T12:00:00.000Z",
-    ...overrides,
-  };
-}
-
-let tmpDir: string;
-
-beforeEach(async () => {
-  tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "file-fallback-test-"));
-  process.env.AILK_INBOX_FALLBACK_DIR = tmpDir;
-});
-
-afterEach(async () => {
-  delete process.env.AILK_INBOX_FALLBACK_DIR;
-  await fs.rm(tmpDir, { recursive: true, force: true });
-});
-
-describe("writeLeadFallback", () => {
-  it("happy path: writes <timestamp>-<id>.json; file content parses back to lead", async () => {
-    const lead = makeLead();
-    const result = await writeLeadFallback(lead);
-
-    expect(result).toMatchObject({ ok: true });
-    if (!result.ok) throw new Error("expected ok");
-
-    const raw = await fs.readFile(result.path, "utf8");
-    const parsed = JSON.parse(raw);
-    expect(parsed).toMatchObject({ id: lead.id, email: lead.email });
-    expect(result.path).toContain(`-${lead.id}.json`);
-  });
-
-  it("directory creation: creates target dir if it does not exist", async () => {
-    const nested = path.join(tmpDir, "new-subdir", "inbox");
-    process.env.AILK_INBOX_FALLBACK_DIR = nested;
-
-    const lead = makeLead();
-    const result = await writeLeadFallback(lead);
-
-    expect(result).toMatchObject({ ok: true });
-    const stat = await fs.stat(nested);
-    expect(stat.isDirectory()).toBe(true);
-  });
-
-  it("invalid createdAt falls back to current ISO timestamp", async () => {
-    const lead = makeLead({ createdAt: "not-a-date" });
-    const result = await writeLeadFallback(lead);
-
-    expect(result).toMatchObject({ ok: true });
-    if (!result.ok) throw new Error("expected ok");
-
-    // Filename must match the ISO-derived pattern: YYYY-MM-DDTHH-MM-SS.mmmZ-<id>.json
-    const filename = path.basename(result.path);
-    expect(filename).toMatch(
-      /^\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}\.\d{3}Z-abc123de\.json$/,
-    );
-  });
-
-  it("path traversal via lead.id: rejected with invalid_id (no fs touch)", async () => {
-    const lead = makeLead({ id: "../../etc/passwd" });
-    const result = await writeLeadFallback(lead);
-
-    expect(result).toMatchObject({ ok: false, error: { kind: "invalid_id" } });
-    const files = await fs.readdir(tmpDir);
-    expect(files).toHaveLength(0);
-  });
-
-  it("path traversal via env var: resolved path stays inside targetDir", async () => {
-    // Env var with traversal — operator-controlled but function validates
-    const resolved = path.resolve(
-      process.cwd(),
-      `${tmpDir}/legit/../../${path.basename(tmpDir)}`,
-    );
-    process.env.AILK_INBOX_FALLBACK_DIR = `${tmpDir}/legit/../../${path.basename(tmpDir)}`;
-
-    const lead = makeLead();
-    const result = await writeLeadFallback(lead);
-
-    // The resolved dir is valid — write succeeds; path stays inside resolved targetDir
-    expect(result).toMatchObject({ ok: true });
-    if (!result.ok) throw new Error("expected ok");
-    expect(result.path.startsWith(resolved)).toBe(true);
-  });
-
-  it("filesystem error: returns fs_error result; does not throw", async () => {
-    // Make targetDir a file (not a directory) to force mkdir failure
-    await fs.rm(tmpDir, { recursive: true });
-    await fs.writeFile(tmpDir, "not-a-dir");
-
-    const lead = makeLead();
-    const result = await writeLeadFallback(lead);
-
-    expect(result).toMatchObject({ ok: false, error: { kind: "fs_error" } });
-  });
-
-  it("Windows-compat: colons are replaced with hyphens in the timestamp portion of the filename", async () => {
-    const lead = makeLead({ createdAt: "2026-05-08T12:00:00.000Z" });
-    const result = await writeLeadFallback(lead);
-
-    expect(result).toMatchObject({ ok: true });
-    if (!result.ok) throw new Error("expected ok");
-
-    const filename = path.basename(result.path);
-    expect(filename).not.toContain(":");
-  });
-
-  it("crafted createdAt traversal: ISO validator rejects non-ISO, falls back to current, writes inside targetDir", async () => {
-    const lead = makeLead({ createdAt: "../2026" });
-    const result = await writeLeadFallback(lead);
-
-    // ISO validator rejects '../2026' → falls back to new Date().toISOString()
-    // Write succeeds inside targetDir; no escape file created
-    expect(result).toMatchObject({ ok: true });
-    if (!result.ok) throw new Error("expected ok");
-    expect(result.path.startsWith(tmpDir)).toBe(true);
-
-    // Confirm no file was written outside tmpDir (escape path would be one level up)
-    const escapedDir = path.resolve(tmpDir, "..");
-    const escapedFile = path.join(escapedDir, `2026-${lead.id}.json`);
-    await expect(fs.stat(escapedFile)).rejects.toThrow();
-  });
-});

package/templates/apps/api/src/lib/__tests__/fixtures/HomePage/home.mdx

@@ -1,8 +0,0 @@
----
-type: HomePage
-slug: home
-title: AI Launch Kit
-description: AX-first OSS template for shipping software with API and MCP.
----
-
-Home content.