create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/lib/__tests__/flow-completion-store.test.ts

@@ -1,149 +0,0 @@
-/**
- * @file flow-completion-store.test.ts
- *
- * A magnet's completion setting — its data boundary (#8757, spec
- * docs/specs/8757-a-per-magnet-completion-setting-spec.md D3, AC-3): every
- * statement is scoped by the workspace it is given, so a write naming another
- * workspace's magnet answers `not_found` and changes nothing, a draft magnet
- * is never a live completion, and the invite caps count only this magnet's
- * leads of this workspace in their window.
- *
- * The world is the in-memory Prisma double (`__tests__/factories/in-memory-prisma`),
- * which refuses a filter it does not model — so scoping that rides on one
- * cannot pass silently.
- */
-// eslint-disable-next-line no-restricted-syntax -- jest mock factory must be hoisted
-jest.mock("../prisma.js", () =>
-  jest
-    .requireActual<typeof import("../../__tests__/factories/in-memory-prisma")>(
-      "../../__tests__/factories/in-memory-prisma",
-    )
-    .createInMemoryPrisma(),
-);
-
-import { prisma } from "../prisma.js";
-import {
-  completionOf,
-  completionsFor,
-  inviteSendCounts,
-  liveCompletionBySlug,
-  setCompletion,
-} from "../flow-completion-store.js";
-
-type Row = Record<string, unknown>;
-// eslint-disable-next-line no-restricted-syntax -- the in-memory double exposes its store on keys the real client type does not declare
-const fake = prisma as unknown as { __db: Record<string, Row[]> };
-
-const WS_A1 = "wksp_00000000-0000-7000-8000-0000000000a1";
-const WS_A2 = "wksp_00000000-0000-7000-8000-0000000000a2";
-const M1 = "flow_00000000-0000-7000-8000-000000000001";
-const M2 = "flow_00000000-0000-7000-8000-000000000002";
-const DRAFT = "flow_00000000-0000-7000-8000-000000000003";
-const NOW = new Date("2026-10-15T12:00:00.000Z");
-
-function magnet(id: string, ws: string, slug: string, status: string, extra: Row = {}): Row {
-  return { id, siteId: ws, workspaceId: ws, slug, title: `Magnet ${slug}`, status, ...extra };
-}
-
-function lead(ws: string, n: number, source: string, email: string, ago: number): Row {
-  return {
-    id: `lead_00000000-0000-7000-8000-${String(n).padStart(12, "0")}`,
-    siteId: ws,
-    workspaceId: ws,
-    source,
-    email,
-    createdAt: new Date(NOW.getTime() - ago),
-  };
-}
-
-beforeEach(() => {
-  const db = fake.__db;
-  for (const key of Object.keys(db)) delete db[key];
-  db.flowDefinition = [
-    magnet(M1, WS_A1, "contact", "live", { completion: "invite", checkoutOffering: null }),
-    magnet(M2, WS_A2, "contact", "live", { completion: "lead", checkoutOffering: null }),
-    magnet(DRAFT, WS_A1, "request-quote", "draft", { completion: "invite", checkoutOffering: null }),
-  ];
-  db.lead = [];
-});
-
-describe("completionsFor (D3)", () => {
-  it("reads only the given workspace's rows; an id absent from it reads as lead", async () => {
-    const settings = await completionsFor(WS_A1, [M1, M2]);
-    expect(completionOf(settings, M1)).toEqual({ completion: "invite", checkoutOffering: null });
-    expect(settings.has(M2)).toBe(false);
-    expect(completionOf(settings, M2)).toEqual({ completion: "lead", checkoutOffering: null });
-  });
-
-  it("reads a row with neither column as lead", async () => {
-    fake.__db.flowDefinition!.push(
-      magnet("flow_00000000-0000-7000-8000-000000000009", WS_A1, "bare", "live"),
-    );
-    const settings = await completionsFor(WS_A1, ["flow_00000000-0000-7000-8000-000000000009"]);
-    expect(completionOf(settings, "flow_00000000-0000-7000-8000-000000000009")).toEqual({
-      completion: "lead",
-      checkoutOffering: null,
-    });
-  });
-});
-
-describe("setCompletion (D3, AC-3)", () => {
-  it("writes exactly the pair onto the workspace's own magnet", async () => {
-    expect(
-      await setCompletion(WS_A1, M1, { completion: "checkout", checkoutOffering: "retainer" }),
-    ).toBe("set");
-    const row = fake.__db.flowDefinition!.find((r) => r.id === M1)!;
-    // `updatedAt` is Prisma-managed (`@updatedAt`); every other column is as it was.
-    expect(row).toEqual({
-      ...magnet(M1, WS_A1, "contact", "live", {
-        completion: "checkout",
-        checkoutOffering: "retainer",
-      }),
-      updatedAt: expect.any(Date),
-    });
-  });
-
-  it("answers not_found for another workspace's magnet and changes nothing", async () => {
-    const before = structuredClone(fake.__db.flowDefinition);
-    expect(await setCompletion(WS_A1, M2, { completion: "invite", checkoutOffering: null })).toBe(
-      "not_found",
-    );
-    expect(fake.__db.flowDefinition).toEqual(before);
-  });
-});
-
-describe("liveCompletionBySlug (D3, AC-3)", () => {
-  it("answers a live magnet's setting and title", async () => {
-    expect(await liveCompletionBySlug(WS_A1, "contact")).toEqual({
-      completion: "invite",
-      checkoutOffering: null,
-      title: "Magnet contact",
-      config: undefined,
-    });
-  });
-
-  it("answers null for a draft row, an absent slug and another workspace's magnet", async () => {
-    expect(await liveCompletionBySlug(WS_A1, "request-quote")).toBeNull();
-    expect(await liveCompletionBySlug(WS_A1, "missing")).toBeNull();
-    fake.__db.flowDefinition = fake.__db.flowDefinition!.filter((r) => r.id !== M1);
-    expect(await liveCompletionBySlug(WS_A1, "contact")).toBeNull();
-  });
-});
-
-describe("inviteSendCounts (D6)", () => {
-  it("counts this magnet's leads of this workspace: the recipient's over a day, all over an hour", async () => {
-    const HOUR = 60 * 60 * 1000;
-    fake.__db.lead = [
-      lead(WS_A1, 1, "flow:contact", "a@b.example", 5 * 60 * 1000),
-      lead(WS_A1, 2, "flow:contact", "a@b.example", 20 * HOUR),
-      lead(WS_A1, 3, "flow:contact", "a@b.example", 25 * HOUR),
-      lead(WS_A1, 4, "flow:contact", "c@d.example", 10 * 60 * 1000),
-      lead(WS_A1, 5, "flow:other", "a@b.example", 60 * 1000),
-      lead(WS_A2, 6, "flow:contact", "a@b.example", 60 * 1000),
-    ];
-    expect(await inviteSendCounts(WS_A1, "contact", "a@b.example", NOW)).toEqual({
-      recipientDay: 2,
-      siteHour: 2,
-    });
-  });
-});

package/templates/apps/api/src/lib/__tests__/flow-rename-race.db.test.ts

@@ -1,116 +0,0 @@
-/**
- * @file flow-rename-race.db.test.ts
- *
- * LIVE-DATABASE proof of #8734 AC-5 (spec
- * docs/specs/8734-magnet-slug-renames-an-anonymous-spec.md D4): two renames
- * racing for one free slug are serialized by `flow_definitions`'
- * `(site_id, slug)` unique key. `flows.rename`'s first write is the
- * definition row, so the second transaction's write waits on the first's
- * uncommitted index entry and, once the first commits, fails with `23505` —
- * which Prisma reports as `P2002` and `rename` answers `conflict`. The pre-
- * checks run at READ COMMITTED and guarantee nothing here; the key does.
- *
- * Runs only when `AILK_TEST_LIVE_DATABASE === "1"` (set beside a real
- * `DATABASE_URL` by `.github/workflows/api-postgres-compat.yml`), and uses the
- * `pg` driver directly, the same reason `rate-limit-cross-isolate.db.test.ts`
- * does: the generated Prisma client is ESM-only and cannot load under this
- * package's CJS ts-jest transform.
- */
-import { Client } from "pg";
-
-const describeDb =
-  process.env.AILK_TEST_LIVE_DATABASE === "1" ? describe : describe.skip;
-
-describeDb("flow_definitions' (site_id, slug) key serializes two renames to one slug (live, #8734 AC-5)", () => {
-  let first: Client;
-  let second: Client;
-  let workspaceId = "";
-  let rowA = "";
-  let rowB = "";
-
-  async function insertRow(slug: string): Promise<string> {
-    const res = await first.query<{ id: string }>(
-      `INSERT INTO "flow_definitions"
-         ("site_id", "workspace_id", "slug", "config", "kind", "title", "status", "customers_enabled", "updated_at")
-       VALUES ($1, $1, $2, '{}'::jsonb, 'contact', $2, 'draft', false, now())
-       RETURNING "id"`,
-      [workspaceId, slug],
-    );
-    return res.rows[0]!.id;
-  }
-
-  /** Until `pid`'s statement is blocked on a lock — the wait the key imposes. */
-  async function waitUntilBlocked(pid: number): Promise<void> {
-    for (let attempt = 0; attempt < 100; attempt++) {
-      const res = await first.query<{ wait_event_type: string | null }>(
-        `SELECT "wait_event_type" FROM pg_stat_activity WHERE "pid" = $1`,
-        [pid],
-      );
-      if (res.rows[0]?.wait_event_type === "Lock") return;
-      await new Promise((resolve) => setTimeout(resolve, 50));
-    }
-    throw new Error("the second rename never waited on the first");
-  }
-
-  beforeAll(async () => {
-    first = new Client({ connectionString: process.env.DATABASE_URL });
-    second = new Client({ connectionString: process.env.DATABASE_URL });
-    await first.connect();
-    await second.connect();
-    const ws = await first.query<{ id: string }>(
-      `SELECT 'wksp_' || uuidv7()::text AS "id"`,
-    );
-    workspaceId = ws.rows[0]!.id;
-    rowA = await insertRow("race-a");
-    rowB = await insertRow("race-b");
-  });
-
-  afterAll(async () => {
-    await first.query(`DELETE FROM "flow_definitions" WHERE "workspace_id" = $1`, [
-      workspaceId,
-    ]);
-    await first.end();
-    await second.end();
-  });
-
-  it("the second rename to one slug waits on the first, then fails 23505 on flow_definitions_site_id_slug_key; one row holds the slug", async () => {
-    const rename = `UPDATE "flow_definitions" SET "slug" = 'race-x' WHERE "id" = $1`;
-    const secondPid = (await second.query<{ pid: number }>("SELECT pg_backend_pid() AS pid"))
-      .rows[0]!.pid;
-
-    let error: { code?: string; constraint?: string } | null | undefined;
-    try {
-      await first.query("BEGIN");
-      await first.query(rename, [rowA]);
-
-      await second.query("BEGIN");
-      // Not awaited: it blocks on the first transaction's uncommitted entry.
-      const loser = second.query(rename, [rowB]).then(
-        () => null,
-        (failure: unknown) => failure as { code?: string; constraint?: string },
-      );
-      await waitUntilBlocked(secondPid);
-
-      await first.query("COMMIT");
-      error = await loser;
-    } finally {
-      await first.query("ROLLBACK");
-      await second.query("ROLLBACK");
-    }
-
-    expect(error).toMatchObject({
-      code: "23505",
-      constraint: "flow_definitions_site_id_slug_key",
-    });
-    const atSlug = await first.query<{ count: string }>(
-      `SELECT count(*) AS "count" FROM "flow_definitions" WHERE "workspace_id" = $1 AND "slug" = 'race-x'`,
-      [workspaceId],
-    );
-    expect(atSlug.rows[0]!.count).toBe("1");
-    const b = await first.query<{ slug: string }>(
-      `SELECT "slug" FROM "flow_definitions" WHERE "id" = $1`,
-      [rowB],
-    );
-    expect(b.rows[0]!.slug).toBe("race-b");
-  });
-});

package/templates/apps/api/src/lib/__tests__/hub-sign-in-store.test.ts

@@ -1,209 +0,0 @@
-/**
- * @file hub-sign-in-store.test.ts
- *
- * The sign-in-client store's operator half (#7894, spec
- * docs/specs/7894-the-hub-signs-in-its-spec.md D3; AC-5): the callback-URL
- * validator and `registerSignInClient`, which the `spokes sign-in-client` CLI
- * calls. The code, grant and lookup functions are exercised through the
- * service and preHandler suites, which run them end to end.
- *
- * External dependency boundary mocked:
- *   - @working-theory/database (via the prisma singleton; __mocks__/prisma.ts)
- */
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../prisma.js");
-
-import {
-  installHubSignInFakeDb,
-  seedSpoke,
-  type FakeHubDb,
-} from "../../__tests__/support/hub-sign-in-fake-db.js";
-import {
-  canonicalRedirectUri,
-  disableSignInClient,
-  HUB_CLIENT_SECRET_PREFIX,
-  mintClientSecret,
-  mintCode,
-  mintCredential,
-  registerSignInClient,
-  sha256Hex,
-} from "../hub-sign-in-store.js";
-import { prisma } from "../prisma.js";
-
-const db = jest.mocked(prisma);
-
-let state: FakeHubDb;
-
-beforeEach(() => {
-  jest.resetAllMocks();
-  state = installHubSignInFakeDb(db);
-});
-
-describe("minting", () => {
-  it("mints the three secrets as 32 random bytes in base64url, each with its own prefix", () => {
-    expect(mintCode()).toMatch(/^[A-Za-z0-9_-]{43}$/);
-    expect(mintCredential()).toMatch(/^ailk_hst_[A-Za-z0-9_-]{43}$/);
-    expect(mintClientSecret()).toMatch(/^ailk_hcs_[A-Za-z0-9_-]{43}$/);
-    expect(new Set(Array.from({ length: 50 }, mintCode)).size).toBe(50);
-  });
-});
-
-describe("canonicalRedirectUri (D3)", () => {
-  it.each([
-    [
-      "https://site.example.com/api/hub-session/callback",
-      "https://site.example.com/api/hub-session/callback",
-    ],
-    [
-      "https://SITE.example.com:443/api/hub-session/callback",
-      "https://site.example.com/api/hub-session/callback",
-    ],
-    [
-      "http://localhost:3000/api/hub-session/callback",
-      "http://localhost:3000/api/hub-session/callback",
-    ],
-    [
-      "http://127.0.0.1:3000/api/hub-session/callback",
-      "http://127.0.0.1:3000/api/hub-session/callback",
-    ],
-  ])("accepts %s", (raw, canonical) => {
-    expect(canonicalRedirectUri(raw)).toBe(canonical);
-  });
-
-  it.each([
-    [
-      "http: on a non-loopback host",
-      "http://site.example.com/api/hub-session/callback",
-    ],
-    ["another path", "https://site.example.com/api/hub-session/other"],
-    ["a trailing slash", "https://site.example.com/api/hub-session/callback/"],
-    ["a query", "https://site.example.com/api/hub-session/callback?x=1"],
-    ["an empty query", "https://site.example.com/api/hub-session/callback?"],
-    ["a fragment", "https://site.example.com/api/hub-session/callback#frag"],
-    ["an empty fragment", "https://site.example.com/api/hub-session/callback#"],
-    ["userinfo", "https://user:pass@site.example.com/api/hub-session/callback"],
-    [
-      "a username alone",
-      "https://user@site.example.com/api/hub-session/callback",
-    ],
-    ["a non-http scheme", "javascript:alert(1)"],
-    ["a relative URL", "/api/hub-session/callback"],
-    ["no URL at all", ""],
-  ])("refuses %s", (_name, raw) => {
-    expect(canonicalRedirectUri(raw)).toBeNull();
-  });
-});
-
-describe("registerSignInClient (the `spokes sign-in-client` CLI)", () => {
-  const goodUri = "https://new.example.com/api/hub-session/callback";
-
-  it("creates the client for the spoke, binds it by id, and returns the secret once", async () => {
-    const { spoke } = seedSpoke(state);
-    state.clients.clear();
-
-    const result = await registerSignInClient({
-      spokeId: spoke.id,
-      redirectUri: goodUri,
-    });
-
-    expect(result.ok).toBe(true);
-    if (!result.ok) return;
-    expect(result.secret.startsWith(HUB_CLIENT_SECRET_PREFIX)).toBe(true);
-
-    const client = state.clients.get(spoke.id);
-    // The client's public id IS the spoke's id (D3), and the secret is a digest.
-    expect(client?.clientId).toBe(spoke.id);
-    expect(client?.clientSecret).toBe(sha256Hex(result.secret));
-    expect(JSON.stringify(client)).not.toContain(result.secret);
-    expect(client?.redirectUris).toEqual([goodUri]);
-    expect(client?.enabled).toBe(true);
-    expect(db.oAuthClient.upsert).toHaveBeenCalledWith(
-      expect.objectContaining({
-        where: { clientId: spoke.id },
-        create: expect.objectContaining({
-          name: spoke.name,
-          scopes: ["account"],
-          trusted: true,
-          enabled: true,
-        }),
-      }),
-    );
-  });
-
-  it("re-running rotates the secret and replaces the callback", async () => {
-    const { spoke } = seedSpoke(state);
-    const first = await registerSignInClient({
-      spokeId: spoke.id,
-      redirectUri: goodUri,
-    });
-    const second = await registerSignInClient({
-      spokeId: spoke.id,
-      redirectUri: "https://other.example.com/api/hub-session/callback",
-    });
-
-    expect(first.ok && second.ok).toBe(true);
-    if (!first.ok || !second.ok) return;
-    expect(second.secret).not.toBe(first.secret);
-    const client = state.clients.get(spoke.id);
-    expect(client?.clientSecret).toBe(sha256Hex(second.secret));
-    expect(client?.redirectUris).toEqual([
-      "https://other.example.com/api/hub-session/callback",
-    ]);
-    expect(state.clients.size).toBe(1);
-  });
-
-  it("re-enables a client that was disabled", async () => {
-    const { spoke, client } = seedSpoke(state);
-    client.enabled = false;
-    const result = await registerSignInClient({
-      spokeId: spoke.id,
-      redirectUri: goodUri,
-    });
-    expect(result.ok).toBe(true);
-    expect(state.clients.get(spoke.id)?.enabled).toBe(true);
-  });
-
-  it("refuses an invalid redirect URI before reading the spoke or writing anything", async () => {
-    const { spoke } = seedSpoke(state);
-    const before = JSON.stringify([...state.clients.values()]);
-    const result = await registerSignInClient({
-      spokeId: spoke.id,
-      redirectUri: "http://site.example.com/api/hub-session/callback",
-    });
-    expect(result).toEqual({ ok: false, reason: "invalid-redirect-uri" });
-    expect(db.oAuthClient.upsert).not.toHaveBeenCalled();
-    expect(JSON.stringify([...state.clients.values()])).toBe(before);
-  });
-
-  it("refuses an unknown spoke and a revoked one", async () => {
-    expect(
-      await registerSignInClient({
-        spokeId: "spoke_nope",
-        redirectUri: goodUri,
-      }),
-    ).toEqual({
-      ok: false,
-      reason: "spoke-not-found",
-    });
-
-    const { spoke } = seedSpoke(state);
-    spoke.revokedAt = new Date();
-    expect(
-      await registerSignInClient({ spokeId: spoke.id, redirectUri: goodUri }),
-    ).toEqual({
-      ok: false,
-      reason: "spoke-revoked",
-    });
-    expect(db.oAuthClient.upsert).not.toHaveBeenCalled();
-  });
-});
-
-describe("disableSignInClient", () => {
-  it("switches the client off and reports whether it had one", async () => {
-    const { spoke, client } = seedSpoke(state);
-    expect(await disableSignInClient(spoke.id)).toBe(true);
-    expect(client.enabled).toBe(false);
-    expect(await disableSignInClient("spoke_nope")).toBe(false);
-  });
-});