create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/routes/project-listings/__tests__/site-answers.test.ts

@@ -1,1022 +0,0 @@
-// Not marked oss: false (D-48/#5366 escalation) — tests the
-// always-shipping project-listings anonymous surface; see
-// routes/project-listings/me.ts's header comment.
-/**
- * @file site-answers.test.ts
- *
- * THE ACCEPTANCE GATE for the anonymous-write bounds on the site-answers
- * store (#5285), and for the three contract fields that became writable
- * beside it.
- *
- * The store is what lets a site ask a question the platform does not read —
- * no column, no migration, no release. The write path is ANONYMOUS: a resume
- * token and nothing else. So every bound on it is read from the site's
- * SERVER-side `SiteListingConfig`, exactly as `wordCaps` and `collectedFields`
- * already are, and the tests below pin each bound to the SITE's number so a
- * cap that came from the package could not pass by coincidence.
- *
- * The tests that would fail QUIETLY, and are the reason this file exists:
- *
- *   - an answer for an undeclared id must 400 with NOTHING written. Dropping
- *     the unknown key instead is indistinguishable, from the client's side,
- *     from a successful save — and hands the size of the store to whoever is
- *     posting into it. Asserted on the ROW, not only on the status code.
- *   - an `operator-only` answer must be absent from the PUBLIC read. A
- *     visibility flag that is declared and never consulted looks identical to
- *     one that is, right up until a founder's private answer is on a page.
- *   - `requestedWindowDays` must be CLAMPED and not stored as posted. The
- *     site's maximum is its commercial terms; a founder who could post their
- *     own bound could post an unbounded one.
- *   - adding three optional fields widens the DEFAULT `collectedFields`
- *     (it derives from the application schema's own shape), so an existing
- *     site's submit floor is pinned as unchanged.
- *
- * Same harness as `configured-application.test.ts`: real routes, real
- * services, mocked `lib/prisma.js` over a small in-memory row store.
- */
-
-// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock
-jest.mock("../../../lib/prisma.js");
-
-jest.mock("@working-theory/email", () => ({
-  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
-}));
-
-jest.mock("@working-theory/license", () => ({
-  checkLicense: jest.fn().mockResolvedValue({
-    tier: "free",
-    plan: null,
-    features: [],
-    expiresAt: null,
-    revoked: false,
-  }),
-}));
-
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-import { SITE_LISTING_CONFIG_DEFAULTS } from "@working-theory/validation";
-
-import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
-import {
-  mockNoWorkspace,
-  mockWorkspaceExists,
-} from "../../../lib/__mocks__/prisma.js";
-import { prisma } from "../../../lib/prisma.js";
-import { listProjectListings } from "../../../services/project-listings.js";
-import { patchProjectListingDraftRoute } from "../patch-draft.js";
-import { projectListingDirectoryRoute } from "../index.js";
-import { publicProjectListingsRoute } from "../public.js";
-import { startProjectListingRoute } from "../start.js";
-import { submitProjectListingRoute } from "../submit.js";
-
-// ─── Fixtures ───────────────────────────────────────────────────────────────
-
-const SITE_ID = "site-1";
-const SITE_KEY = "pk-site-1";
-
-const opt = (value: string, label: string) => ({ value, label });
-
-const VALID_QUESTIONS = {
-  q2: {
-    prompt: "Why are you here?",
-    options: [opt("scale", "Scaling my team"), opt("just-curious", "Just curious")],
-  },
-  q3: { prompt: "Stage?", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
-  q4: { prompt: "Team size?", options: [opt("a", "A"), opt("b", "B"), opt("c", "C")] },
-  q5: {
-    prompt: "Urgency?",
-    options: [opt("urgent", "Now"), opt("planning", "Soon"), opt("exploring", "Someday")],
-  },
-  q6: {
-    prompt: "Pain?",
-    options: [
-      opt("low", "Low"),
-      opt("medium", "Medium"),
-      opt("high", "High"),
-      opt("critical", "Critical"),
-    ],
-  },
-  q7: { prompt: "Anything else?" },
-  extras: [],
-};
-
-const START_PAYLOAD = {
-  siteKey: SITE_KEY,
-  founderName: "Ada Founder",
-  founderEmail: "ada@example.com",
-  consent: true,
-};
-
-/** Everything the screens after step one collect, under the default config. */
-const COMPLETE_APPLICATION = {
-  name: "My Project",
-  headline: "Ten words or fewer for the tile title here",
-  oneLiner: "A short sentence describing what the project does for its people.",
-  problem: "The problem is real and this describes it.",
-  product: "wireframes",
-  commitment: "part-time",
-  teamComposition: "co-founders",
-  faqs: [
-    { question: "Q one?", answer: "A one." },
-    { question: "Q two?", answer: "A two." },
-    { question: "Q three?", answer: "A three." },
-  ],
-  address: "1 Founder Way, Springfield",
-  questions: VALID_QUESTIONS,
-};
-
-/**
- * The `collectedFields` an operator wrote BEFORE #5285 — the roster as it
- * stood, with none of the three new fields in it. A stored list like this is
- * what every configured site is actually running on.
- */
-/**
- * A site that DELIBERATELY asks for the three #5285 fields. They are opt-in:
- * excluded from the platform's default mask so that adding them to the payload
- * could not silently widen what an anonymous caller may write on a site that
- * never asked. Every round-trip test below therefore configures this rather
- * than leaning on the default.
- */
-const COLLECTED_WITH_OPT_IN = [
-  ...SITE_LISTING_CONFIG_DEFAULTS.collectedFields,
-  "logoMarkUrl",
-  "logoWordmarkUrl",
-  "requestedWindowDays",
-  // #5096 — the fourth. Same opt-in treatment for the same reason.
-  "solution",
-];
-
-const COLLECTED_BEFORE_5285 = [
-  "name",
-  "headline",
-  "oneLiner",
-  "problem",
-  "url",
-  "product",
-  "commitment",
-  "teamComposition",
-  "faqs",
-  "anythingElse",
-  "address",
-  "founderCompany",
-  "questions",
-];
-
-/** A site that asks four questions of its own, one of them for itself only. */
-const SITE_ANSWERS_CONFIG = {
-  maxQuestions: 3,
-  maxAnswerLength: 40,
-  questions: [
-    { id: "why_now", control: "textarea", maxLength: 10 },
-    { id: "referrer", control: "select", options: ["twitter", "friend"] },
-    { id: "demo_url", control: "url" },
-    { id: "billing_email", control: "email", visibility: "operator-only" },
-  ],
-};
-
-// ─── The in-memory row store the Prisma mock is backed by ───────────────────
-
-type Row = Record<string, unknown>;
-
-let rows: Row[];
-let nextId: number;
-/** The `SiteListingConfig.data` blob this site runs on; `null` means no row. */
-let configData: Record<string, unknown> | null;
-
-function matches(row: Row, where: Record<string, unknown>): boolean {
-  return Object.entries(where).every(([key, value]) => {
-    if (key === "OR") {
-      return (value as Record<string, unknown>[]).some((clause) => matches(row, clause));
-    }
-    if (value !== null && typeof value === "object" && !(value instanceof Date)) {
-      const clause = value as Record<string, unknown>;
-      if ("in" in clause) return (clause["in"] as unknown[]).includes(row[key]);
-      if ("not" in clause) return row[key] !== clause["not"];
-      if ("gt" in clause) return (row[key] as Date) > (clause["gt"] as Date);
-      if ("startsWith" in clause) {
-        return (
-          typeof row[key] === "string" &&
-          (row[key] as string).startsWith(clause["startsWith"] as string)
-        );
-      }
-    }
-    return row[key] === value;
-  });
-}
-
-function installStore(): void {
-  // #6335 — the shared prisma mock no longer resolves ANY requested
-  // workspace id. `startProjectListingDraft` stamps the row's `workspaceId`
-  // by resolving the site it was filed against (`resolveWorkspaceIdForSite`,
-  // services/project-listings.ts), so this suite states the ONE site it is
-  // built around. Keyed on the requested id — nothing else resolves.
-  mockWorkspaceExists(prisma, SITE_ID);
-
-  rows = [];
-  nextId = 1;
-  configData = null;
-
-  (prisma.lead.create as jest.Mock).mockImplementation(() =>
-    Promise.resolve({ id: `lead_00000000-0000-7000-8000-00000000000${nextId}` }),
-  );
-
-  (prisma.siteListingConfig.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { siteId?: string; publicKey?: string } }) => {
-      if (where.publicKey !== undefined) {
-        return Promise.resolve(where.publicKey === SITE_KEY ? { siteId: SITE_ID } : null);
-      }
-      return Promise.resolve(configData === null ? null : { data: configData });
-    },
-  );
-
-  (prisma.consentGrant.createMany as jest.Mock).mockImplementation(
-    ({ data }: { data: Row[] }) => Promise.resolve({ count: data.length }),
-  );
-
-  (prisma.$transaction as jest.Mock).mockImplementation(
-    async (fn: (tx: typeof prisma) => Promise<unknown>) => fn(prisma),
-  );
-
-  (prisma.projectListing.create as jest.Mock).mockImplementation(({ data }: { data: Row }) => {
-    const now = new Date();
-    const row: Row = {
-      id: `prjl_00000000-0000-7000-8000-00000000000${nextId++}`,
-      slug: null,
-      name: null,
-      oneLiner: null,
-      problem: null,
-      url: null,
-      product: null,
-      commitment: null,
-      teamComposition: null,
-      faqs: null,
-      anythingElse: null,
-      address: null,
-      addressLine1: null,
-      addressLine2: null,
-      addressCity: null,
-      addressRegion: null,
-      addressPostalCode: null,
-      addressCountry: null,
-      questions: null,
-      siteAnswers: null,
-      // #5407 — a row written before the columns existed, and a freshly
-      // started draft on a site that asks for one name line: parts null,
-      // no phone, no verification stamp.
-      founderFirstName: null,
-      founderLastName: null,
-      founderPhone: null,
-      emailVerifiedAt: null,
-      founderCompany: null,
-      leadId: null,
-      headline: null,
-      logoMarkUrl: null,
-      logoWordmarkUrl: null,
-      solution: null,
-      featured: false,
-      decidedAt: null,
-      decidedBy: null,
-      issueUrl: null,
-      experimentKey: null,
-      windowDays: null,
-      windowEndsAt: null,
-      createdAt: now,
-      updatedAt: now,
-      ...data,
-    };
-    rows.push(row);
-    return Promise.resolve(row);
-  });
-
-  (prisma.projectListing.findFirst as jest.Mock).mockImplementation(
-    ({ where }: { where: Record<string, unknown> }) =>
-      Promise.resolve(rows.find((row) => matches(row, where)) ?? null),
-  );
-
-  (prisma.projectListing.findMany as jest.Mock).mockImplementation(
-    ({ where }: { where: Record<string, unknown> }) =>
-      Promise.resolve(rows.filter((row) => matches(row, where))),
-  );
-
-  (prisma.projectListing.update as jest.Mock).mockImplementation(
-    ({ where, data }: { where: Record<string, unknown>; data: Row }) => {
-      const row = rows.find((r) => matches(r, where));
-      Object.assign(row!, data, { updatedAt: new Date() });
-      return Promise.resolve(row);
-    },
-  );
-
-  (prisma.projectListing.updateMany as jest.Mock).mockImplementation(
-    ({ where, data }: { where: Record<string, unknown>; data: Row }) => {
-      const matched = rows.filter((r) => matches(r, where));
-      matched.forEach((r) => Object.assign(r, data, { updatedAt: new Date() }));
-      return Promise.resolve({ count: matched.length });
-    },
-  );
-}
-
-// ─── Helpers ────────────────────────────────────────────────────────────────
-
-const bearer = (token: string) => ({ authorization: `Bearer ${token}` });
-
-async function buildApp(): Promise<FastifyInstance> {
-  const app = Fastify();
-  await app.register(startProjectListingRoute);
-  await app.register(patchProjectListingDraftRoute);
-  await app.register(submitProjectListingRoute);
-  await app.register(publicProjectListingsRoute);
-  await app.ready();
-  return app;
-}
-
-async function startDraft(
-  app: FastifyInstance,
-): Promise<{ id: string; resumeToken: string }> {
-  const res = await app.inject({
-    method: "POST",
-    url: "/v1/project-listings",
-    payload: START_PAYLOAD,
-  });
-  expect(res.statusCode).toBe(201);
-  return (res.json() as { data: { id: string; resumeToken: string } }).data;
-}
-
-const patch = (
-  app: FastifyInstance,
-  draft: { id: string; resumeToken: string },
-  payload: Record<string, unknown>,
-) =>
-  app.inject({
-    method: "PATCH",
-    url: `/v1/project-listings/drafts/${draft.id}`,
-    headers: bearer(draft.resumeToken),
-    payload,
-  });
-
-const submit = (app: FastifyInstance, draft: { id: string; resumeToken: string }) =>
-  app.inject({
-    method: "POST",
-    url: `/v1/project-listings/drafts/${draft.id}/submit`,
-    headers: bearer(draft.resumeToken),
-  });
-
-const publicRead = (app: FastifyInstance) =>
-  app.inject({ method: "GET", url: `/v1/project-listings/public?siteKey=${SITE_KEY}` });
-
-const messageOf = (res: { json: () => unknown }) =>
-  (res.json() as { error: { message: string } }).error.message;
-
-/** Approve the one row in the store, so it reaches the public read. */
-function publish(): void {
-  Object.assign(rows[0]!, {
-    status: "active",
-    decidedAt: new Date(),
-    windowEndsAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),
-  });
-}
-
-// ─── Tests ──────────────────────────────────────────────────────────────────
-
-describe("the site-answers store's anonymous-write bounds (#5285)", () => {
-  setupLeadFileEnv("project-listing-site-answers");
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    installStore();
-    app = await buildApp();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  // ── The declaration is the gate ──
-
-  describe("the declaration list is the gate", () => {
-    it("patch: refuses an answer for an id the site did NOT declare, and writes NOTHING", async () => {
-      // THE property of this change. A dropped key looks like a saved key to
-      // the client that sent it, and would leave the size of this store in the
-      // hands of whoever is posting into it.
-      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
-      const draft = await startDraft(app);
-
-      const res = await patch(app, draft, {
-        siteAnswers: { why_now: "June", what_colour: "blue" },
-      });
-
-      expect(res.statusCode).toBe(400);
-      expect(messageOf(res)).toContain("what_colour");
-      // The declared answer beside it did not land either — the body is
-      // refused whole, not per key.
-      expect(rows[0]!["siteAnswers"]).toBeNull();
-    });
-
-    it("patch: a site that declares NOTHING accepts no site answer at all", async () => {
-      // The default, and what every unconfigured site runs on: the store
-      // cannot be written by a caller who merely knows the field name.
-      configData = null;
-      const draft = await startDraft(app);
-
-      const res = await patch(app, draft, { siteAnswers: { why_now: "June" } });
-
-      expect(res.statusCode).toBe(400);
-      expect(rows[0]!["siteAnswers"]).toBeNull();
-    });
-
-    it("patch: stores a declared answer", async () => {
-      // The other half of every pair above — without it, a surface that
-      // refused everything would pass them all.
-      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
-      const draft = await startDraft(app);
-
-      const res = await patch(app, draft, { siteAnswers: { why_now: "June" } });
-
-      expect(res.statusCode).toBe(200);
-      expect(rows[0]!["siteAnswers"]).toEqual({ why_now: "June" });
-    });
-
-    it("patch: MERGES answers rather than replacing them — a founder saves one screen at a time", async () => {
-      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
-      const draft = await startDraft(app);
-
-      await patch(app, draft, { siteAnswers: { why_now: "June" } });
-      const res = await patch(app, draft, { siteAnswers: { referrer: "friend" } });
-
-      expect(res.statusCode).toBe(200);
-      expect(rows[0]!["siteAnswers"]).toEqual({ why_now: "June", referrer: "friend" });
-    });
-  });
-
-  // ── The caps are the site's own numbers ──
-
-  describe("the caps come from the site's config", () => {
-    it("patch: refuses more answers than the site's maxQuestions, naming the site's number", async () => {
-      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
-      const draft = await startDraft(app);
-
-      const res = await patch(app, draft, {
-        siteAnswers: {
-          why_now: "June",
-          referrer: "friend",
-          demo_url: "https://example.com",
-          billing_email: "ada@example.com",
-        },
-      });
-
-      expect(res.statusCode).toBe(400);
-      // Pinned to the SITE's three. A message naming the platform's twenty
-      // would mean the cap never came from this site's row.
-      expect(messageOf(res)).toContain("at most 3");
-      expect(rows[0]!["siteAnswers"]).toBeNull();
-    });
-
-    it("patch: refuses an answer longer than the site's per-question cap", async () => {
-      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
-      const draft = await startDraft(app);
-
-      const over = await patch(app, draft, { siteAnswers: { why_now: "x".repeat(11) } });
-      const at = await patch(app, draft, { siteAnswers: { why_now: "x".repeat(10) } });
-
-      expect(over.statusCode).toBe(400);
-      expect(messageOf(over)).toContain("10 characters");
-      expect(at.statusCode).toBe(200);
-      expect(rows[0]!["siteAnswers"]).toEqual({ why_now: "x".repeat(10) });
-    });
-
-    it("patch: refuses a select answer outside the options the site declared", async () => {
-      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
-      const draft = await startDraft(app);
-
-      const outside = await patch(app, draft, { siteAnswers: { referrer: "billboard" } });
-      const inside = await patch(app, draft, { siteAnswers: { referrer: "twitter" } });
-
-      expect(outside.statusCode).toBe(400);
-      expect(messageOf(outside)).toContain("billboard");
-      expect(inside.statusCode).toBe(200);
-      expect(rows[0]!["siteAnswers"]).toEqual({ referrer: "twitter" });
-    });
-
-    it("patch: enforces the declared control — a url answer must be http(s)", async () => {
-      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
-      const draft = await startDraft(app);
-
-      const bad = await patch(app, draft, { siteAnswers: { demo_url: "javascript:alert(1)" } });
-
-      expect(bad.statusCode).toBe(400);
-      expect(rows[0]!["siteAnswers"]).toBeNull();
-    });
-  });
-
-  // ── Visibility ──
-
-  describe("operator-only answers never reach the public read", () => {
-    it("the public read carries the public answer and NOT the operator-only one", async () => {
-      // A visibility flag that is declared and never consulted looks exactly
-      // like one that is — until a founder's private answer is on a page.
-      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
-      const draft = await startDraft(app);
-      await patch(app, draft, { siteAnswers: { why_now: "June" } });
-      await patch(app, draft, { siteAnswers: { billing_email: "ada@example.com" } });
-      await patch(app, draft, COMPLETE_APPLICATION);
-      await submit(app, draft);
-      publish();
-
-      const res = await publicRead(app);
-
-      expect(res.statusCode).toBe(200);
-      const [listing] = (res.json() as { data: { siteAnswers: Record<string, string> }[] }).data;
-      expect(listing!.siteAnswers).toEqual({ why_now: "June" });
-      expect(listing!.siteAnswers).not.toHaveProperty("billing_email");
-      // And the value itself is nowhere in the serialized response at all.
-      expect(res.payload).not.toContain("ada@example.com");
-    });
-
-    it("the tenant dashboard read carries BOTH — it is the audience operator-only exists for", async () => {
-      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
-      const draft = await startDraft(app);
-      await patch(app, draft, { siteAnswers: { why_now: "June" } });
-      await patch(app, draft, { siteAnswers: { billing_email: "ada@example.com" } });
-
-      const [listing] = await listProjectListings(SITE_ID);
-
-      expect(listing!.siteAnswers).toEqual({
-        why_now: "June",
-        billing_email: "ada@example.com",
-      });
-    });
-
-    it("an answer whose id the site no longer declares is dropped from the public read", async () => {
-      // "No declaration" carries no visibility, and no visibility cannot be
-      // read as public on the read that publishes.
-      configData = { siteAnswers: SITE_ANSWERS_CONFIG };
-      const draft = await startDraft(app);
-      await patch(app, draft, { siteAnswers: { why_now: "June" } });
-      await patch(app, draft, COMPLETE_APPLICATION);
-      await submit(app, draft);
-      publish();
-
-      // The operator retires the question after the answer was written.
-      configData = { siteAnswers: { ...SITE_ANSWERS_CONFIG, questions: [] } };
-      const res = await publicRead(app);
-
-      const [listing] = (res.json() as { data: { siteAnswers: Record<string, string> }[] }).data;
-      expect(listing!.siteAnswers).toEqual({});
-      // Still on the row — the founder's answer is not destroyed, only unpublished.
-      expect(rows[0]!["siteAnswers"]).toEqual({ why_now: "June" });
-    });
-  });
-
-  // ── The four contract fields ──
-
-  describe("the four contract fields that became writable", () => {
-    it("patch: the two logo urls round-trip onto the row, on a site that asked", async () => {
-      configData = { collectedFields: COLLECTED_WITH_OPT_IN };
-      const draft = await startDraft(app);
-
-      const res = await patch(app, draft, {
-        logoMarkUrl: "https://cdn.example.com/mark.svg",
-        logoWordmarkUrl: "https://cdn.example.com/wordmark.svg",
-      });
-
-      expect(res.statusCode).toBe(200);
-      expect(rows[0]!["logoMarkUrl"]).toBe("https://cdn.example.com/mark.svg");
-      expect(rows[0]!["logoWordmarkUrl"]).toBe("https://cdn.example.com/wordmark.svg");
-    });
-
-    it("patch: REFUSES all four on a site that never opted in, writing nothing", async () => {
-      // The defect the back-compat review found, at the route. `collectedFields`
-      // defaults to every field the payload defines, so adding these three
-      // silently made them writable on every site that had configured nothing —
-      // and the logo fields ride the PUBLIC read as image sources. An anonymous
-      // caller holding a resume token could have attached a third-party image
-      // to the public listing card of a site that never asked for a logo.
-      configData = null;
-      const draft = await startDraft(app);
-
-      for (const body of [
-        { logoMarkUrl: "https://evil.example/a.png" },
-        { logoWordmarkUrl: "https://evil.example/b.svg" },
-        { requestedWindowDays: 9000 },
-        { solution: "Text a site never asked for." },
-      ]) {
-        expect((await patch(app, draft, body)).statusCode).toBe(400);
-      }
-
-      expect(rows[0]!["logoMarkUrl"]).toBeNull();
-      expect(rows[0]!["logoWordmarkUrl"]).toBeNull();
-      expect(rows[0]!["solution"]).toBeNull();
-    });
-
-    it("patch: refuses a logo url that is not http(s) — they render as image sources", async () => {
-      configData = { collectedFields: COLLECTED_WITH_OPT_IN };
-      const draft = await startDraft(app);
-
-      const res = await patch(app, draft, { logoMarkUrl: "javascript:alert(1)" });
-
-      expect(res.statusCode).toBe(400);
-      expect(rows[0]!["logoMarkUrl"]).toBeNull();
-    });
-
-    it("patch: CLAMPS requestedWindowDays to the site's maximum rather than storing what was posted", async () => {
-      // The one that would fail silently and expensively: an unclamped value
-      // is a founder setting their own commercial terms. The three numbers are
-      // deliberately distinct — 14 (the site's default, written at start), 90
-      // (what was asked for) and 45 (the site's maximum, what must be stored).
-      configData = {
-        maxWindowDays: 45,
-        defaultWindowDays: 14,
-        collectedFields: COLLECTED_WITH_OPT_IN,
-      };
-      const draft = await startDraft(app);
-      expect(rows[0]!["windowDays"]).toBe(14);
-
-      const res = await patch(app, draft, { requestedWindowDays: "90" });
-
-      expect(res.statusCode).toBe(200);
-      expect(rows[0]!["windowDays"]).toBe(45);
-    });
-
-    it("patch: stores a requested window BELOW the site's maximum as asked", async () => {
-      configData = {
-        maxWindowDays: 45,
-        defaultWindowDays: 14,
-        collectedFields: COLLECTED_WITH_OPT_IN,
-      };
-      const draft = await startDraft(app);
-
-      await patch(app, draft, { requestedWindowDays: 21 });
-
-      expect(rows[0]!["windowDays"]).toBe(21);
-    });
-
-    it("patch: refuses a window that is not a positive whole number of days", async () => {
-      configData = {
-        maxWindowDays: 45,
-        defaultWindowDays: 14,
-        collectedFields: COLLECTED_WITH_OPT_IN,
-      };
-      const draft = await startDraft(app);
-
-      expect((await patch(app, draft, { requestedWindowDays: 0 })).statusCode).toBe(400);
-      expect((await patch(app, draft, { requestedWindowDays: -7 })).statusCode).toBe(400);
-      expect((await patch(app, draft, { requestedWindowDays: "soon" })).statusCode).toBe(400);
-      expect(rows[0]!["windowDays"]).toBe(14);
-    });
-  });
-
-  // ── The floor the three new fields must not move ──
-
-  describe("submit requirements are unchanged by the four added fields", () => {
-    it("the four are OPT-IN, absent from the default collected set, and never required at submit", async () => {
-      // This assertion was inverted by the back-compat review. The default
-      // `collectedFields` derives from the application schema's own shape, so
-      // adding a field WIDENED what an anonymous caller could write on every
-      // site that never wrote an explicit mask — and the two logo fields ride
-      // the public read and render as image sources. They are excluded from
-      // the default now; a site that wants them names them.
-      for (const field of [
-        "logoMarkUrl",
-        "logoWordmarkUrl",
-        "requestedWindowDays",
-        "solution",
-      ]) {
-        expect(SITE_LISTING_CONFIG_DEFAULTS.collectedFields).not.toContain(field);
-      }
-
-      configData = null;
-      const draft = await startDraft(app);
-      await patch(app, draft, COMPLETE_APPLICATION); // carries none of the three
-
-      const res = await submit(app, draft);
-
-      expect(res.statusCode).toBe(200);
-      expect(rows[0]!["status"]).toBe("requested");
-      expect(rows[0]!["logoMarkUrl"]).toBeNull();
-      expect(rows[0]!["logoWordmarkUrl"]).toBeNull();
-      expect(rows[0]!["solution"]).toBeNull();
-    });
-
-    it("a site whose stored collectedFields predates #5285 submits exactly as it did", async () => {
-      // What every configured site is actually running on: a list written
-      // before these three existed. It must keep working untouched.
-      configData = { collectedFields: COLLECTED_BEFORE_5285 };
-      const draft = await startDraft(app);
-      await patch(app, draft, COMPLETE_APPLICATION);
-
-      const res = await submit(app, draft);
-
-      expect(res.statusCode).toBe(200);
-      expect(rows[0]!["status"]).toBe("requested");
-    });
-
-    it("a site whose stored collectedFields predates #5285 cannot have a logo written into it", async () => {
-      // The collected set is a WRITE gate as well as a completeness floor
-      // (#5048 D5): a site that never asks for a logo must not have one
-      // written by an anonymous caller who knows the field name.
-      configData = { collectedFields: COLLECTED_BEFORE_5285 };
-      const draft = await startDraft(app);
-
-      const res = await patch(app, draft, { logoMarkUrl: "https://cdn.example.com/m.svg" });
-
-      expect(res.statusCode).toBe(400);
-      expect(rows[0]!["logoMarkUrl"]).toBeNull();
-    });
-
-    it("the missing-field list an empty draft is refused with names none of the three", async () => {
-      configData = null;
-      const draft = await startDraft(app);
-      await patch(app, draft, { name: "My Project" });
-
-      const res = await submit(app, draft);
-
-      expect(res.statusCode).toBe(422);
-      const body = res.json() as { error: { missingFields: string[] } };
-      expect(body.error.missingFields).not.toContain("logoMarkUrl");
-      expect(body.error.missingFields).not.toContain("logoWordmarkUrl");
-      expect(body.error.missingFields).not.toContain("requestedWindowDays");
-      expect(body.error.missingFields).not.toContain("solution");
-    });
-  });
-
-  // ── #5096 — `solution` round-trips for a site that asked ──
-
-  describe("the `solution` field (#5096)", () => {
-    it("patch: persists it onto the row, on a site that asked", async () => {
-      configData = { collectedFields: COLLECTED_WITH_OPT_IN };
-      const draft = await startDraft(app);
-
-      const res = await patch(app, draft, { solution: "We publish the answer, not the page." });
-
-      expect(res.statusCode).toBe(200);
-      expect(rows[0]!["solution"]).toBe("We publish the answer, not the page.");
-    });
-
-    it("patch: refuses an empty solution and one over 600 chars", async () => {
-      configData = { collectedFields: COLLECTED_WITH_OPT_IN };
-      const draft = await startDraft(app);
-
-      expect((await patch(app, draft, { solution: "" })).statusCode).toBe(400);
-      expect((await patch(app, draft, { solution: "x".repeat(601) })).statusCode).toBe(400);
-      expect(rows[0]!["solution"]).toBeNull();
-    });
-
-    // The half that would fail QUIETLY: `submit` validates an application
-    // reassembled from the ROW, and a stored value the reassembly drops is
-    // indistinguishable — from the founder's side — from one that saved.
-    it("submit: the stored solution survives the row-reassembly `submit` validates", async () => {
-      configData = { collectedFields: COLLECTED_WITH_OPT_IN };
-      const draft = await startDraft(app);
-      await patch(app, draft, COMPLETE_APPLICATION);
-      await patch(app, draft, { solution: "We publish the answer, not the page." });
-
-      const res = await submit(app, draft);
-
-      expect(res.statusCode).toBe(200);
-      expect(rows[0]!["status"]).toBe("requested");
-      expect(rows[0]!["solution"]).toBe("We publish the answer, not the page.");
-    });
-  });
-});
-
-// ── #6335 — the explicit workspace setup above is load-bearing ────────────
-//
-// Every case in this file states that this suite's site has a workspace.
-// This one takes that away, and proves the statement was doing work rather
-// than decorating the setup: `startProjectListingDraft` resolves the site it
-// is filing against (`resolveWorkspaceIdForSite`, services/project-listings.ts)
-// and refuses BEFORE any row is written. With the shared prisma mock's old
-// permissive default in place this case could not be written at all — every
-// id resolved, so the fail-closed path was unreachable from a route test.
-describe("#6335 — start fails closed when the site names no workspace", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    installStore();
-    mockNoWorkspace(prisma);
-    app = await buildApp();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("answers 503 tenant_unresolved and creates no ProjectListing", async () => {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/project-listings",
-      payload: START_PAYLOAD,
-    });
-
-    expect(res.statusCode).toBe(503);
-    expect((res.json() as { error: { code: string } }).error.code).toBe(
-      "tenant_unresolved",
-    );
-    expect(prisma.projectListing.create).not.toHaveBeenCalled();
-    expect(rows).toHaveLength(0);
-  });
-});
-
-// ─── #7521 — a listicle's own Application fields ────────────────────────────
-//
-// A draft a LIVE listicle captured (#6314's `capturedByFlowId`) may answer
-// that listicle's eligible Application fields — `text`/`textarea`/`url`/
-// `select` with no `mapsTo` — with the same per-control checks the site's own
-// questions get. The accepted entry's directory profile publishes them, minus
-// the owner's `privateFields` and any id the site itself declares.
-describe("a captured draft answers its listicle's Application fields (#7521 AC-2)", () => {
-  setupLeadFileEnv("project-listing-listicle-answers");
-  let app: FastifyInstance;
-  let flows: Row[];
-
-  const en = (value: string) => ({ en: value });
-  function listicle(overrides: Row = {}, listing?: Record<string, unknown>): Row {
-    return {
-      id: "flow_partners",
-      siteId: SITE_ID,
-      workspaceId: SITE_ID,
-      slug: "partners-apply",
-      kind: "listicle",
-      status: "live",
-      landingPage: "/partners",
-      createdAt: new Date("2026-09-01T00:00:00.000Z"),
-      config: {
-        slug: "partners-apply",
-        defaultLocale: "en",
-        steps: [
-          {
-            key: "application",
-            type: "field",
-            copy: { title: en("Apply") },
-            fields: [
-              { name: "full_name", inputType: "text", mapsTo: "name", copy: { label: en("Name") } },
-              { name: "email", inputType: "email", mapsTo: "email", copy: { label: en("Email") } },
-              { name: "phone", inputType: "tel", mapsTo: "phone", copy: { label: en("Phone") } },
-              { name: "website", inputType: "url", copy: { label: en("Website") } },
-              {
-                name: "stage",
-                inputType: "select",
-                options: [
-                  { value: "idea", label: en("Idea") },
-                  { value: "live", label: en("Live") },
-                ],
-                copy: { label: en("Stage") },
-              },
-              { name: "about", inputType: "textarea", copy: { label: en("About") } },
-            ],
-          },
-        ],
-        ...(listing !== undefined && { listing }),
-      },
-      ...overrides,
-    };
-  }
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    installStore();
-    flows = [listicle()];
-    (prisma.flowDefinition.findFirst as jest.Mock).mockImplementation(
-      ({ where }: { where: Record<string, unknown> }) =>
-        Promise.resolve(flows.find((f) => matches(f, where)) ?? null),
-    );
-    (prisma.flowDefinition.findMany as jest.Mock).mockImplementation(
-      ({ where }: { where: Record<string, unknown> }) =>
-        Promise.resolve(flows.filter((f) => matches(f, where))),
-    );
-    (prisma.waitlistScore.groupBy as jest.Mock).mockResolvedValue([]);
-    app = Fastify();
-    await app.register(startProjectListingRoute);
-    await app.register(patchProjectListingDraftRoute);
-    await app.register(publicProjectListingsRoute);
-    await app.register(projectListingDirectoryRoute);
-    await app.ready();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  async function startCaptured(): Promise<{ id: string; resumeToken: string }> {
-    const res = await app.inject({
-      method: "POST",
-      url: "/v1/project-listings",
-      payload: { ...START_PAYLOAD, capturedByFlowSlug: "partners-apply" },
-    });
-    expect(res.statusCode).toBe(201);
-    expect(rows[0]!["capturedByFlowId"]).toBe("flow_partners");
-    return (res.json() as { data: { id: string; resumeToken: string } }).data;
-  }
-
-  /** Accept the one row, so it reaches the directory. */
-  function accept(): void {
-    Object.assign(rows[0]!, {
-      slug: "acme",
-      name: "Acme",
-      status: "active",
-      decidedAt: new Date(),
-      windowEndsAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),
-    });
-  }
-
-  async function profile(): Promise<Array<Record<string, string>>> {
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/project-listings/directory?siteKey=${SITE_KEY}&landingPage=/partners`,
-    });
-    expect(res.statusCode).toBe(200);
-    const data = (res.json() as { data: { entries: Array<{ profile: Array<Record<string, string>> }> } }).data;
-    return data.entries[0]!.profile;
-  }
-
-  it("saves answers to the listicle's eligible fields on a captured draft", async () => {
-    const draft = await startCaptured();
-
-    const res = await patch(app, draft, { siteAnswers: { website: "https://x.test", stage: "live" } });
-
-    expect(res.statusCode).toBe(200);
-    expect(rows[0]!["siteAnswers"]).toEqual({ website: "https://x.test", stage: "live" });
-  });
-
-  it("refuses a contact field and a non-http link, writing nothing", async () => {
-    const draft = await startCaptured();
-
-    const email = await patch(app, draft, { siteAnswers: { email: "a@b.test" } });
-    const script = await patch(app, draft, { siteAnswers: { website: "javascript:alert(1)" } });
-
-    expect(email.statusCode).toBe(400);
-    expect(script.statusCode).toBe(400);
-    expect(rows[0]!["siteAnswers"]).toBeNull();
-  });
-
-  it("refuses the same answers on an uncaptured draft", async () => {
-    const draft = await startDraft(app);
-
-    const res = await patch(app, draft, { siteAnswers: { website: "https://x.test" } });
-
-    expect(res.statusCode).toBe(400);
-    expect(rows[0]!["siteAnswers"]).toBeNull();
-  });
-
-  it("refuses answers on a draft a DRAFT-status listicle captured", async () => {
-    const draft = await startCaptured();
-    flows[0]!["status"] = "draft";
-
-    const res = await patch(app, draft, { siteAnswers: { website: "https://x.test" } });
-
-    expect(res.statusCode).toBe(400);
-    expect(rows[0]!["siteAnswers"]).toBeNull();
-  });
-
-  it("refuses a 501-character url answer", async () => {
-    const draft = await startCaptured();
-
-    const res = await patch(app, draft, {
-      siteAnswers: { website: `https://x.test/${"a".repeat(486)}` },
-    });
-
-    expect(res.statusCode).toBe(400);
-    expect(rows[0]!["siteAnswers"]).toBeNull();
-  });
-
-  it("a site-declared operator-only `about` keeps its visibility: off /public and off the profile", async () => {
-    configData = {
-      siteAnswers: { questions: [{ id: "about", control: "textarea", visibility: "operator-only" }] },
-    };
-    const draft = await startCaptured();
-
-    const res = await patch(app, draft, {
-      siteAnswers: { website: "https://x.test", about: "for the operator" },
-    });
-    expect(res.statusCode).toBe(200);
-    accept();
-
-    expect((await profile()).map((row) => row["name"])).toEqual(["website"]);
-    const publicRead = await app.inject({
-      method: "GET",
-      url: `/v1/project-listings/public?siteKey=${SITE_KEY}`,
-    });
-    expect(publicRead.body).not.toContain("for the operator");
-  });
-
-  it("listing.privateFields keeps `stage` off the profile while the answer stays stored", async () => {
-    flows = [listicle({}, { privateFields: ["stage"] })];
-    const draft = await startCaptured();
-    await patch(app, draft, { siteAnswers: { website: "https://x.test", stage: "live" } });
-    accept();
-
-    expect((await profile()).map((row) => row["name"])).toEqual(["website"]);
-    expect(rows[0]!["siteAnswers"]).toEqual({ website: "https://x.test", stage: "live" });
-  });
-
-  it("a `javascript:` value stored while the field was `text` comes back as kind text", async () => {
-    await startCaptured();
-    accept();
-    rows[0]!["siteAnswers"] = { website: "javascript:x" };
-
-    expect(await profile()).toEqual([
-      { name: "website", label: "Website", value: "javascript:x", kind: "text" },
-    ]);
-  });
-});