create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/middleware/__tests__/default-tenant.test.ts

@@ -1,721 +0,0 @@
-/**
- * @file default-tenant.test.ts
- *
- * Tenant-isolation coverage for the BASE-build tenant guard (#5677) —
- * `middleware/default-tenant.ts`, the guard a build WITHOUT the multi-tenant
- * module runs so the already-built review dashboard is reachable at Pro.
- *
- * SECURITY-SENSITIVE (tenant isolation). Two load-bearing groups here. The
- * OPERATOR-PIN cases are the #5693 security-review remediation: on this build
- * the review surface and `isPlatformOperator`'s unfiltered `{kind: "all"}`
- * scope became reachable together, so the guard seats only the caller whose
- * email matches `AILK_OPERATOR_EMAIL` and seats nobody when it is unset —
- * including a caller who already holds the operator Membership. The FOREIGN
- * WORKSPACE case is the other: a single-tenant caller naming another workspace's id in the
- * URL is refused with the same 403 the paid slice returns, before any lookup
- * of the target. This proves the base path did not relax the default-deny
- * posture — it reproduces it. The multi-tenant slice's own isolation tests
- * (`services/__tests__/tenant-context.test.ts`, #3631) are untouched and cover
- * the module path.
- *
- * Mocks the module-level `prisma` singleton via the repo's manual-mock
- * convention — `resolveDefaultTenant` reads the singleton directly and has no
- * DI seam, the same shape `tenant-context.test.ts` uses.
- */
-
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
-jest.mock("../../lib/prisma.js");
-
-import { prisma } from "../../lib/prisma.js";
-import type { Id } from "@working-theory/ids";
-
-import { defaultTenantPreHandlerPlugin } from "../default-tenant.js";
-import { resolveDefaultTenant } from "../../services/default-tenant.js";
-
-// The reserved-range sentinel values from database/tenancy.ts (ADR-0031
-// rule 7) — re-declared here as literals so the test pins the WIRE values,
-// not whatever the constants happen to be.
-const DEFAULT_ORG_ID = "org_00000000-0000-7000-8000-000000000001";
-const DEFAULT_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000001";
-const OPERATOR_MEMBERSHIP_ID =
-  "member_00000000-0000-7000-8000-000000000001";
-
-/** A workspace id belonging to somebody else — never this caller's. */
-const FOREIGN_WORKSPACE_ID = "wksp_01936b2c-0000-7000-8000-00000000beef";
-
-const USER_ID = "solo-operator" as Id<"user">;
-const OPERATOR_EMAIL = "operator@example.com";
-
-/**
- * Stubs the single-tenant prerequisites `resolveDefaultTenant` checks:
- * `workspace.count() === 1` and the sentinel default Workspace present on the
- * sentinel default Organization.
- */
-function mockSingleTenantWorkspace(): void {
-  (prisma.workspace.count as jest.Mock).mockResolvedValue(1);
-  (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
-    id: DEFAULT_WORKSPACE_ID,
-    organizationId: DEFAULT_ORG_ID,
-  });
-}
-
-/**
- * The caller holds the operator Membership on the default Organization AND is
- * the pinned operator — the only combination this guard grants on.
- */
-function mockBoundOperator(): void {
-  (prisma.user.findUnique as jest.Mock).mockResolvedValue({
-    email: OPERATOR_EMAIL,
-    emailVerified: true,
-  });
-  (prisma.membership.create as jest.Mock).mockResolvedValue({});
-  (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
-    role: "owner",
-  });
-}
-
-/**
- * Builds an app whose routes sit behind the base guard. `authenticated`
- * mirrors what the dual-mode auth preHandler decorates upstream: a cookie
- * session sets both `userId` and `sessionTenant`; a bearer request sets only
- * `userId`.
- */
-function buildApp(
-  authenticated: "cookie" | "bearer" | "none" = "cookie",
-): FastifyInstance {
-  const app = Fastify();
-  app.addHook("preHandler", async (req) => {
-    if (authenticated === "none") return;
-    req.userId = USER_ID;
-    if (authenticated === "cookie") {
-      req.sessionTenant = {
-        sessionRowId: "session-1" as Id<"session">,
-        activeOrganizationId: null,
-        activeWorkspaceId: null,
-      };
-    }
-  });
-  app.register(defaultTenantPreHandlerPlugin);
-  app.get("/scoped", async (req) => ({
-    workspaceId: req.tenant?.workspaceId ?? null,
-    role: req.tenant?.role ?? null,
-  }));
-  app.get("/workspaces/:workspaceId/config", async (req) => ({
-    workspaceId: req.tenant?.workspaceId ?? null,
-  }));
-  // The `workspace` module's settings-route GET shape (#5371) — the surface
-  // #5515 item 1 asks about. Stubbed rather than imported: what is under test
-  // is which tenant the GUARD yields to it, not what the handler then reads.
-  app.get("/workspaces/:workspaceId/general", async (req) => ({
-    workspaceId: req.tenant?.workspaceId ?? null,
-  }));
-  return app;
-}
-
-const ORIGINAL_ENV = process.env;
-
-beforeEach(() => {
-  jest.clearAllMocks();
-  process.env = { ...ORIGINAL_ENV };
-  // Pinned by default: this guard grants on no other configuration, so the
-  // cases below would all be trivially 403 without it.
-  process.env.AILK_OPERATOR_EMAIL = OPERATOR_EMAIL;
-});
-
-afterAll(() => {
-  process.env = ORIGINAL_ENV;
-});
-
-/**
- * #5515 item 1 — `AILK_OPERATOR_EMAIL` is REQUIRED for a workspace-module
- * deployment, and that requirement is what keeps the TOFU operator bind from
- * firing on a settings-route GET.
- *
- * The #5513 review raised this against `apps/api/src/services/tenant-context.ts`
- * before #5677 moved the resolution: registering the `workspace` module's
- * routes under `isModuleEnabled("workspace") || isModuleEnabled("multi-tenant")`
- * put a `tenantPreHandler` route on a build that has no multi-tenant module,
- * so the concern was that the first authenticated account to load the module's
- * Admin pages (`/admin`, renamed from `/workspace` by #5637) would TOFU-bind
- * itself as org owner off a plain settings GET.
- *
- * On a workspace-only build `server.ts`'s `tenantPreHandlerForBuild()` picks
- * THIS guard, which calls `resolveDefaultTenantForOperator` — so the pin is
- * mandatory and unset fails CLOSED. These two cases are the objective record
- * of that, pinned to the settings-route shape rather than the review surface:
- * with the pin unset the bind never runs and the route is 403 to everyone;
- * with it set, only the pinned operator is seated. The documentation half of
- * this item is `.env.example` and `apps/api/CLAUDE.md`. Redesigning #3631's
- * TOFU was explicitly out of scope.
- */
-describe("workspace-module settings route — the operator pin is required (#5515 item 1)", () => {
-  const settingsPath = `/workspaces/${DEFAULT_WORKSPACE_ID}/general`;
-
-  it("DENIES a settings-route GET when AILK_OPERATOR_EMAIL is UNSET — and the TOFU bind never fires", async () => {
-    delete process.env.AILK_OPERATOR_EMAIL;
-    mockSingleTenantWorkspace();
-    mockBoundOperator();
-
-    const app = buildApp();
-    const res = await app.inject({ method: "GET", url: settingsPath });
-
-    expect(res.statusCode).toBe(403);
-    // The load-bearing assertion: no Membership is minted off a settings GET.
-    expect(prisma.membership.create).not.toHaveBeenCalled();
-    await app.close();
-  });
-
-  it("GRANTS the same settings-route GET once AILK_OPERATOR_EMAIL pins the caller", async () => {
-    process.env.AILK_OPERATOR_EMAIL = OPERATOR_EMAIL;
-    mockSingleTenantWorkspace();
-    mockBoundOperator();
-
-    const app = buildApp();
-    const res = await app.inject({ method: "GET", url: settingsPath });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.json()).toEqual({ workspaceId: DEFAULT_WORKSPACE_ID });
-    await app.close();
-  });
-
-  it("DENIES a settings-route GET from a caller who is NOT the pinned operator, minting nothing", async () => {
-    process.env.AILK_OPERATOR_EMAIL = OPERATOR_EMAIL;
-    mockSingleTenantWorkspace();
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
-      email: "first-visitor@example.com",
-      emailVerified: true,
-    });
-
-    const app = buildApp();
-    const res = await app.inject({ method: "GET", url: settingsPath });
-
-    expect(res.statusCode).toBe(403);
-    expect(prisma.membership.create).not.toHaveBeenCalled();
-    await app.close();
-  });
-});
-
-describe("default tenant guard — isolation (#5677)", () => {
-  it("DENIES a foreign workspaceId with 403, before any lookup of the target", async () => {
-    mockSingleTenantWorkspace();
-    mockBoundOperator();
-    const app = buildApp();
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/workspaces/${FOREIGN_WORKSPACE_ID}/config`,
-    });
-
-    expect(res.statusCode).toBe(403);
-    expect(res.json()).toEqual({
-      ok: false,
-      error: { code: "forbidden", message: "Forbidden" },
-    });
-    // No enumeration: the foreign id is never handed to a lookup. The only
-    // workspace read is `resolveDefaultTenant`'s own by-sentinel-id read.
-    const workspaceReads = (prisma.workspace.findUnique as jest.Mock).mock.calls;
-    expect(workspaceReads).toHaveLength(1);
-    expect(workspaceReads[0]?.[0]?.where?.id).toBe(DEFAULT_WORKSPACE_ID);
-    await app.close();
-  });
-
-  it("GRANTS the caller's OWN workspaceId — the same URL shape, its own id", async () => {
-    mockSingleTenantWorkspace();
-    mockBoundOperator();
-    const app = buildApp();
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/workspaces/${DEFAULT_WORKSPACE_ID}/config`,
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.json()).toEqual({ workspaceId: DEFAULT_WORKSPACE_ID });
-    await app.close();
-  });
-
-  it("resolves the SEEDED default workspace for an authenticated site owner — no tenant is synthesized", async () => {
-    mockSingleTenantWorkspace();
-    mockBoundOperator();
-    const app = buildApp();
-
-    const res = await app.inject({ method: "GET", url: "/scoped" });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.json()).toEqual({
-      workspaceId: DEFAULT_WORKSPACE_ID,
-      role: "owner",
-    });
-    await app.close();
-  });
-
-  it("DENIES a caller holding no Membership on the default Organization (a second OAuth sign-in after TOFU)", async () => {
-    mockSingleTenantWorkspace();
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
-      email: OPERATOR_EMAIL,
-      emailVerified: true,
-    });
-    (prisma.membership.create as jest.Mock).mockRejectedValue({ code: "P2002" });
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue(null);
-    const app = buildApp();
-
-    const res = await app.inject({ method: "GET", url: "/scoped" });
-
-    expect(res.statusCode).toBe(403);
-    await app.close();
-  });
-
-  it("DENIES once a SECOND workspace exists — the guard never grants outside an unambiguously single-tenant deployment", async () => {
-    (prisma.workspace.count as jest.Mock).mockResolvedValue(2);
-    mockBoundOperator();
-    const app = buildApp();
-
-    const res = await app.inject({ method: "GET", url: "/scoped" });
-
-    expect(res.statusCode).toBe(403);
-    expect(prisma.workspace.findUnique).not.toHaveBeenCalled();
-    await app.close();
-  });
-
-  it("DENIES when the sole workspace is NOT the well-known default", async () => {
-    (prisma.workspace.count as jest.Mock).mockResolvedValue(1);
-    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue(null);
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
-      email: OPERATOR_EMAIL,
-      emailVerified: true,
-    });
-    const app = buildApp();
-
-    const res = await app.inject({ method: "GET", url: "/scoped" });
-
-    expect(res.statusCode).toBe(403);
-    await app.close();
-  });
-
-  it("DENIES when the sole default workspace hangs off a NON-sentinel organization", async () => {
-    (prisma.workspace.count as jest.Mock).mockResolvedValue(1);
-    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue({
-      id: DEFAULT_WORKSPACE_ID,
-      organizationId: "org_01936b2c-0000-7000-8000-00000000beef",
-    });
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
-      email: OPERATOR_EMAIL,
-      emailVerified: true,
-    });
-    const app = buildApp();
-
-    const res = await app.inject({ method: "GET", url: "/scoped" });
-
-    expect(res.statusCode).toBe(403);
-    expect(prisma.membership.create).not.toHaveBeenCalled();
-    await app.close();
-  });
-
-  it("DENIES a bearer-authenticated caller with 403 — no workspace binding on an agent token (#3591)", async () => {
-    mockSingleTenantWorkspace();
-    mockBoundOperator();
-    const app = buildApp("bearer");
-
-    const res = await app.inject({ method: "GET", url: "/scoped" });
-
-    expect(res.statusCode).toBe(403);
-    expect(prisma.workspace.count).not.toHaveBeenCalled();
-    await app.close();
-  });
-
-  it("DENIES when AILK_OPERATOR_EMAIL is UNSET, even for a caller holding the owner Membership — an unpinned deployment seats nobody (#5693 security review)", async () => {
-    delete process.env.AILK_OPERATOR_EMAIL;
-    mockSingleTenantWorkspace();
-    mockBoundOperator();
-    const app = buildApp();
-
-    const res = await app.inject({ method: "GET", url: "/scoped" });
-
-    expect(res.statusCode).toBe(403);
-    // Fails closed BEFORE the TOFU bind: an unpinned deployment must not seat
-    // whoever authenticates first, because `isPlatformOperator` would later
-    // promote exactly that identity to an unfiltered read.
-    expect(prisma.membership.create).not.toHaveBeenCalled();
-    expect(prisma.workspace.count).not.toHaveBeenCalled();
-    await app.close();
-  });
-
-  it("DENIES a caller who ALREADY HOLDS the owner Membership but is not the pinned operator — a squatter bound before the pin existed stays denied (#5693 security review)", async () => {
-    mockSingleTenantWorkspace();
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
-      email: "squatter@evil.example",
-      emailVerified: true,
-    });
-    (prisma.membership.create as jest.Mock).mockResolvedValue({});
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
-      role: "owner",
-    });
-    const app = buildApp();
-
-    const res = await app.inject({ method: "GET", url: "/scoped" });
-
-    expect(res.statusCode).toBe(403);
-    // The Membership row is not enough — the email is re-checked per request,
-    // so a pre-existing bind cannot be inherited by adding the pin later.
-    expect(prisma.workspace.count).not.toHaveBeenCalled();
-    await app.close();
-  });
-
-  it("GRANTS the pinned operator case-insensitively, with surrounding whitespace trimmed", async () => {
-    process.env.AILK_OPERATOR_EMAIL = "  OPERATOR@Example.COM  ";
-    mockSingleTenantWorkspace();
-    mockBoundOperator();
-    const app = buildApp();
-
-    const res = await app.inject({ method: "GET", url: "/scoped" });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.json()).toEqual({
-      workspaceId: DEFAULT_WORKSPACE_ID,
-      role: "owner",
-    });
-    await app.close();
-  });
-
-  it("DENIES the pinned operator whose email is UNVERIFIED — an unverified address is an unproven claim to the pin", async () => {
-    mockSingleTenantWorkspace();
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
-      email: OPERATOR_EMAIL,
-      emailVerified: false,
-    });
-    const app = buildApp();
-
-    const res = await app.inject({ method: "GET", url: "/scoped" });
-
-    expect(res.statusCode).toBe(403);
-    expect(prisma.workspace.count).not.toHaveBeenCalled();
-    await app.close();
-  });
-
-  it("DENIES when the pinned caller has no User row", async () => {
-    mockSingleTenantWorkspace();
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue(null);
-    const app = buildApp();
-
-    const res = await app.inject({ method: "GET", url: "/scoped" });
-
-    expect(res.statusCode).toBe(403);
-    await app.close();
-  });
-
-  it("returns 401 for an unauthenticated caller", async () => {
-    const app = buildApp("none");
-
-    const res = await app.inject({ method: "GET", url: "/scoped" });
-
-    expect(res.statusCode).toBe(401);
-    await app.close();
-  });
-});
-
-/**
- * The MULTI-TENANT reach into the same bind (#5701 AC-2). `resolveActiveTenant`
- * (`services/tenant-context.ts:89`) calls `resolveDefaultTenant` directly, so
- * `bindOperatorMembership` is reached WITHOUT the verified-email gate that
- * `resolveDefaultTenantForOperator` — the base-build entry the guard above
- * exercises — applies first. These cases drive that entry point directly,
- * which is the only way to observe the bind's own check; through the plugin
- * the wrapper would refuse first and the assertion would prove nothing.
- */
-describe("resolveDefaultTenant — the operator bind's own verified-email check (#5701)", () => {
-  it("does NOT create the Membership when the pinned address matches but emailVerified is false", async () => {
-    mockSingleTenantWorkspace();
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
-      id: USER_ID,
-      email: OPERATOR_EMAIL,
-      emailVerified: false,
-    });
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue(null);
-
-    const result = await resolveDefaultTenant(USER_ID);
-
-    expect(result).toBeNull();
-    // The bind is the escalation: an unverified address is an unproven claim
-    // to the pin, so no `owner` Membership may be minted from it.
-    expect(prisma.membership.create).not.toHaveBeenCalled();
-  });
-
-  it("does NOT create the Membership when the pinned caller has no User row", async () => {
-    mockSingleTenantWorkspace();
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue(null);
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue(null);
-
-    const result = await resolveDefaultTenant(USER_ID);
-
-    expect(result).toBeNull();
-    expect(prisma.membership.create).not.toHaveBeenCalled();
-  });
-
-  it("CREATES the Membership when the pinned address matches and emailVerified is true — unchanged behaviour", async () => {
-    mockSingleTenantWorkspace();
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
-      id: USER_ID,
-      email: OPERATOR_EMAIL,
-      emailVerified: true,
-    });
-    (prisma.membership.create as jest.Mock).mockResolvedValue({});
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
-      role: "owner",
-    });
-
-    const result = await resolveDefaultTenant(USER_ID);
-
-    expect(prisma.membership.create).toHaveBeenCalledTimes(1);
-    expect((prisma.membership.create as jest.Mock).mock.calls[0]?.[0]).toEqual({
-      data: {
-        id: OPERATOR_MEMBERSHIP_ID,
-        organizationId: DEFAULT_ORG_ID,
-        userId: USER_ID,
-        role: "owner",
-      },
-    });
-    expect(result).toEqual({
-      userId: USER_ID,
-      organizationId: DEFAULT_ORG_ID,
-      workspaceId: DEFAULT_WORKSPACE_ID,
-      role: "owner",
-    });
-  });
-
-  it("leaves the UNPINNED branch untouched — no User read, pure TOFU bind (#5701 D4)", async () => {
-    delete process.env.AILK_OPERATOR_EMAIL;
-    mockSingleTenantWorkspace();
-    (prisma.membership.create as jest.Mock).mockResolvedValue({});
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
-      role: "owner",
-    });
-
-    const result = await resolveDefaultTenant(USER_ID);
-
-    // No pin means no email comparison at all — the bind stays first-caller-wins.
-    expect(prisma.user.findUnique).not.toHaveBeenCalled();
-    expect(prisma.membership.create).toHaveBeenCalledTimes(1);
-    expect(result).toEqual({
-      userId: USER_ID,
-      organizationId: DEFAULT_ORG_ID,
-      workspaceId: DEFAULT_WORKSPACE_ID,
-      role: "owner",
-    });
-  });
-
-  it("still swallows the OPERATOR_MEMBERSHIP_ID unique violation — the TOFU race is unchanged", async () => {
-    mockSingleTenantWorkspace();
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
-      id: USER_ID,
-      email: OPERATOR_EMAIL,
-      emailVerified: true,
-    });
-    (prisma.membership.create as jest.Mock).mockRejectedValue({ code: "P2002" });
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue(null);
-
-    await expect(resolveDefaultTenant(USER_ID)).resolves.toBeNull();
-  });
-});
-
-// ── #3591 — the base-build agent branch (spec D5, D6, D7) ───────────────────
-
-describe("defaultTenantPreHandler — agents (#3591 D5, D7)", () => {
-  const AGENT_ID = "agent_00000000-0000-7000-8000-0000000000c1" as Id<"agent">;
-
-  function agentBinding(
-    overrides: Partial<{
-      workspaceId: string;
-      organizationId: string;
-      responsibleMembershipId: string;
-      grants: string[];
-    }> = {},
-  ) {
-    return {
-      agentId: AGENT_ID,
-      workspaceId: (overrides.workspaceId ?? DEFAULT_WORKSPACE_ID) as Id<"workspace">,
-      organizationId: (overrides.organizationId ?? DEFAULT_ORG_ID) as Id<"organization">,
-      responsibleMembershipId: (overrides.responsibleMembershipId ??
-        OPERATOR_MEMBERSHIP_ID) as Id<"membership">,
-      permissionLevel: "member" as const,
-      grants: overrides.grants ?? [],
-    };
-  }
-
-  /** An agent caller: `request.agent` set, `request.sessionTenant` never. */
-  function buildAgentApp(agent: ReturnType<typeof agentBinding>): FastifyInstance {
-    const app = Fastify();
-    app.addHook("preHandler", async (req) => {
-      req.userId = USER_ID;
-      req.agent = agent;
-    });
-    app.register(defaultTenantPreHandlerPlugin);
-    app.get("/scoped", async (req) => ({ tenant: req.tenant ?? null }));
-    app.get("/workspaces/:workspaceId/general", async (req) => ({
-      workspaceId: req.tenant?.workspaceId ?? null,
-    }));
-    return app;
-  }
-
-  function mockOperatorMembership(): void {
-    mockBoundOperator();
-    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
-      id: OPERATOR_MEMBERSHIP_ID,
-      role: "owner",
-    });
-  }
-
-  it("the pinned operator's agent, bound to the default workspace, is granted the operator's tenant with role member", async () => {
-    mockSingleTenantWorkspace();
-    mockOperatorMembership();
-    const app = buildAgentApp(agentBinding());
-
-    const res = await app.inject({ method: "GET", url: "/scoped" });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.json().tenant).toEqual({
-      userId: USER_ID,
-      organizationId: DEFAULT_ORG_ID,
-      workspaceId: DEFAULT_WORKSPACE_ID,
-      role: "member",
-      agent: true,
-    });
-    await app.close();
-  });
-
-  it("a granted agent of the owner-operator carries its grants on the tenant; a forged one is dropped (#7864 D3)", async () => {
-    mockSingleTenantWorkspace();
-    mockOperatorMembership();
-    const app = buildAgentApp(
-      agentBinding({ grants: ["magnets-manage", "agents-manage", "content-edit"] }),
-    );
-
-    const res = await app.inject({ method: "GET", url: "/scoped" });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.json().tenant).toEqual({
-      userId: USER_ID,
-      organizationId: DEFAULT_ORG_ID,
-      workspaceId: DEFAULT_WORKSPACE_ID,
-      role: "member",
-      agent: true,
-      grants: ["content-edit", "magnets-manage"],
-    });
-    await app.close();
-  });
-
-  it("reaches the grant through the operator's own reads: the same membership compound key", async () => {
-    mockSingleTenantWorkspace();
-    mockOperatorMembership();
-    const app = buildAgentApp(agentBinding());
-
-    await app.inject({ method: "GET", url: "/scoped" });
-
-    expect(prisma.membership.findUnique).toHaveBeenCalledWith({
-      where: {
-        organizationId_userId: { organizationId: DEFAULT_ORG_ID, userId: USER_ID },
-      },
-      select: { id: true, role: true },
-    });
-    await app.close();
-  });
-
-  it.each([
-    ["bound to another workspace", { workspaceId: FOREIGN_WORKSPACE_ID }],
-    ["created under another membership", { responsibleMembershipId: "member_00000000-0000-7000-8000-0000000000dd" }],
-    ["of another organization", { organizationId: "org_00000000-0000-7000-8000-0000000000dd" }],
-  ])("refuses (403) an agent %s", async (_label, overrides) => {
-    mockSingleTenantWorkspace();
-    mockOperatorMembership();
-    const app = buildAgentApp(agentBinding(overrides));
-
-    const res = await app.inject({ method: "GET", url: "/scoped" });
-
-    expect(res.statusCode).toBe(403);
-    await app.close();
-  });
-
-  it("refuses (403) the agent of a person who is not the pinned operator, before any membership read", async () => {
-    mockSingleTenantWorkspace();
-    mockOperatorMembership();
-    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
-      email: "someone-else@example.com",
-      emailVerified: true,
-    });
-    const app = buildAgentApp(agentBinding());
-
-    const res = await app.inject({ method: "GET", url: "/scoped" });
-
-    expect(res.statusCode).toBe(403);
-    expect(prisma.membership.findUnique).not.toHaveBeenCalled();
-    await app.close();
-  });
-
-  it("refuses (403) every agent when the operator pin is unset", async () => {
-    delete process.env.AILK_OPERATOR_EMAIL;
-    mockSingleTenantWorkspace();
-    mockOperatorMembership();
-    const app = buildAgentApp(agentBinding());
-
-    const res = await app.inject({ method: "GET", url: "/scoped" });
-
-    expect(res.statusCode).toBe(403);
-    await app.close();
-  });
-
-  it("refuses (403) an agent naming a foreign workspace in the URL, before the handler runs", async () => {
-    mockSingleTenantWorkspace();
-    mockOperatorMembership();
-    const app = buildAgentApp(agentBinding());
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/workspaces/${FOREIGN_WORKSPACE_ID}/general`,
-    });
-
-    expect(res.statusCode).toBe(403);
-    await app.close();
-  });
-});
-
-describe("defaultTenantPreHandlerPlugin — the tenantGuarded tag (#3591 D6)", () => {
-  it("tags every route registered after it in its scope, and no route before it or outside it", async () => {
-    // A root onRoute hook runs first and keeps each route's options object;
-    // the guard's own hook then tags that same object.
-    const routes: Record<string, { config?: { tenantGuarded?: boolean } }> = {};
-    const app = Fastify();
-    app.addHook("onRoute", (opts) => {
-      if (opts.method === "GET") routes[opts.url] = opts;
-    });
-    app.get("/before", async () => ({}));
-    app.register(async (scope) => {
-      scope.get("/scope-before", async () => ({}));
-      await scope.register(defaultTenantPreHandlerPlugin);
-      scope.get("/after", async () => ({}));
-      await scope.register(async (child) => {
-        child.get("/child", async () => ({}));
-      });
-    });
-    app.register(async (sibling) => {
-      sibling.get("/sibling", async () => ({}));
-    });
-    await app.ready();
-    const tagged = Object.fromEntries(
-      ["/before", "/scope-before", "/after", "/child", "/sibling"].map((url) => [
-        url,
-        routes[url]?.config?.tenantGuarded,
-      ]),
-    );
-
-    expect(tagged).toEqual({
-      "/before": undefined,
-      "/scope-before": undefined,
-      "/after": true,
-      "/child": true,
-      "/sibling": undefined,
-    });
-    await app.close();
-  });
-});