create-ailk 0.24.0 → 0.26.0

package/templates/apps/api/src/routes/project-listings/__tests__/site-key.test.ts

@@ -1,484 +0,0 @@
-// Not marked oss: false (D-48/#5366 escalation) — tests the
-// always-shipping project-listings anonymous surface; see
-// routes/project-listings/me.ts's header comment.
-/**
- * @file site-key.test.ts
- *
- * THE ACCEPTANCE GATE for the PUBLIC SITE KEY (#5048 D2) — the change that
- * takes the tenant identifier out of the request body entirely.
- *
- * `projectListingStartSchema` carried `siteId`. A body-supplied tenant
- * identifier is exactly what the consuming site's proxy route existed to
- * prevent, so the body now carries `siteKey` and the server resolves the site
- * from `SiteListingConfig.publicKey` (`services/listing-config.ts`'s
- * `siteIdForPublicKey`). The same key names the site on the public read.
- *
- * The half that matters is the REFUSAL half, and it is why this file exists
- * apart from `drafts.test.ts`: a `siteId` that were merely *ignored* would
- * look identical from the outside to one that is refused, right up until a
- * caller pairs a valid key with a foreign `siteId` and something downstream
- * reads the wrong one. `projectListingStartSchema` is `.strict()`, so both
- * bodies are a 400 — and that is asserted here rather than assumed.
- *
- * Same harness as `drafts.test.ts`: real routes, real services, the mocked
- * `lib/prisma.js` over a small in-memory row store, so "the draft was filed
- * against THAT site" is read back off the stored row rather than off the
- * response the route happens to echo.
- */
-
-// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock
-jest.mock("../../../lib/prisma.js");
-
-jest.mock("@working-theory/email", () => ({
-  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-test" }),
-  // #5406 — `start` now reaches the resume email. Declared here for the reason
-  // docs/lessons/project-listings/04 records: a mock factory that omits an
-  // export the code under test calls leaves it `undefined` at the callsite.
-  // These suites configure no `resumeEmail`, so the send short-circuits before
-  // this is reached; it is declared so a future fixture that DOES configure
-  // one fails on its assertion rather than on a missing mock.
-  sendListingResumeEmail: jest.fn().mockResolvedValue({ ok: true, messageId: "msg-resume" }),
-}));
-
-jest.mock("@working-theory/license", () => ({
-  checkLicense: jest.fn().mockResolvedValue({
-    tier: "free",
-    plan: null,
-    features: [],
-    expiresAt: null,
-    revoked: false,
-  }),
-}));
-
-import { DEFAULT_WORKSPACE_ID } from "@working-theory/database/tenancy";
-import Fastify from "fastify";
-import type { FastifyInstance } from "fastify";
-
-import {
-  mockNoWorkspace,
-  mockSentinelWorkspaceExists,
-  mockWorkspaceExists,
-} from "../../../lib/__mocks__/prisma.js";
-import { prisma } from "../../../lib/prisma.js";
-import { __resetSiteWorkspaceCacheForTests } from "../../../lib/site.js";
-import { publicProjectListingsRoute } from "../public.js";
-import { startProjectListingRoute } from "../start.js";
-
-// ─── Fixtures ───────────────────────────────────────────────────────────────
-
-/** Two sites, each reachable ONLY by its own public key. */
-const SITE_A = "site-a";
-const KEY_A = "pk-site-a";
-const SITE_B = "site-b";
-const KEY_B = "pk-site-b";
-
-const KEYS_TO_SITES: Record<string, string> = { [KEY_A]: SITE_A, [KEY_B]: SITE_B };
-
-const START_PAYLOAD = {
-  siteKey: KEY_A,
-  founderName: "Ada Founder",
-  founderEmail: "ada@example.com",
-  consent: true,
-};
-
-// ─── The in-memory row store the Prisma mock is backed by ───────────────────
-
-type Row = Record<string, unknown>;
-
-let rows: Row[];
-let nextId: number;
-
-function matches(row: Row, where: Record<string, unknown>): boolean {
-  return Object.entries(where).every(([key, value]) => {
-    if (key === "OR") {
-      return (value as Record<string, unknown>[]).some((clause) => matches(row, clause));
-    }
-    if (value !== null && typeof value === "object" && !(value instanceof Date)) {
-      const clause = value as Record<string, unknown>;
-      if ("in" in clause) return (clause["in"] as unknown[]).includes(row[key]);
-      if ("not" in clause) return row[key] !== clause["not"];
-      if ("gt" in clause) return (row[key] as Date) > (clause["gt"] as Date);
-      if ("startsWith" in clause) {
-        return (
-          typeof row[key] === "string" &&
-          (row[key] as string).startsWith(clause["startsWith"] as string)
-        );
-      }
-    }
-    return row[key] === value;
-  });
-}
-
-function installStore(): void {
-  rows = [];
-  nextId = 1;
-
-  // #6335 — the shared prisma mock no longer resolves ANY requested
-  // workspace id, so this suite states the two sites it is built around.
-  // `resolveWorkspaceIdForSite` (services/project-listings.ts) keys on the
-  // requested id, and nothing else resolves: the env-alias cases below add
-  // the ONE further id each of them expects, and the stamp suite's refusal
-  // case takes them all away.
-  mockWorkspaceExists(prisma, SITE_A, SITE_B);
-
-  // One delegate, two lookups (#5048 D2): `where.publicKey` is the site-key
-  // resolution, `where.siteId` the per-site config read. No config row for the
-  // latter, so the platform defaults apply.
-  (prisma.siteListingConfig.findUnique as jest.Mock).mockImplementation(
-    ({ where }: { where: { siteId?: string; publicKey?: string } }) => {
-      if (where.publicKey !== undefined) {
-        const siteId = KEYS_TO_SITES[where.publicKey];
-        return Promise.resolve(siteId ? { siteId } : null);
-      }
-      return Promise.resolve(null);
-    },
-  );
-
-  // #5275 — the grant write `start` makes after the row. Append-only; it only
-  // needs to resolve here (drafts.test.ts asserts on what it is called with).
-  (prisma.consentGrant.createMany as jest.Mock).mockImplementation(
-    ({ data }: { data: Row[] }) => Promise.resolve({ count: data.length }),
-  );
-
-  // #5275 — `start` writes the row and its grant in one interactive
-  // transaction; the mock hands the same store-backed client through.
-  (prisma.$transaction as jest.Mock).mockImplementation(
-    async (fn: (tx: typeof prisma) => Promise<unknown>) => fn(prisma),
-  );
-  (prisma.projectListing.create as jest.Mock).mockImplementation(({ data }: { data: Row }) => {
-    const now = new Date();
-    const row: Row = {
-      id: `prjl_00000000-0000-7000-8000-00000000000${nextId++}`,
-      slug: null,
-      name: null,
-      oneLiner: null,
-      problem: null,
-      url: null,
-      product: null,
-      commitment: null,
-      teamComposition: null,
-      faqs: null,
-      anythingElse: null,
-      address: null,
-      questions: null,
-      // #5407 — a row written before the columns existed, and a freshly
-      // started draft on a site that asks for one name line: parts null,
-      // no phone, no verification stamp.
-      founderFirstName: null,
-      founderLastName: null,
-      founderPhone: null,
-      emailVerifiedAt: null,
-      founderCompany: null,
-      leadId: null,
-      headline: null,
-      logoMarkUrl: null,
-      logoWordmarkUrl: null,
-      solution: null,
-      featured: false,
-      decidedAt: null,
-      decidedBy: null,
-      issueUrl: null,
-      experimentKey: null,
-      windowEndsAt: null,
-      createdAt: now,
-      updatedAt: now,
-      ...data,
-    };
-    rows.push(row);
-    return Promise.resolve(row);
-  });
-
-  (prisma.projectListing.findFirst as jest.Mock).mockImplementation(
-    ({ where }: { where: Record<string, unknown> }) =>
-      Promise.resolve(rows.find((row) => matches(row, where)) ?? null),
-  );
-
-  (prisma.projectListing.findMany as jest.Mock).mockImplementation(
-    ({ where }: { where: Record<string, unknown> }) =>
-      Promise.resolve(rows.filter((row) => matches(row, where))),
-  );
-}
-
-/** An `active`, publicly-readable listing on one site. */
-function seedActiveListing(siteId: string, slug: string): void {
-  rows.push({
-    id: `prjl_00000000-0000-7000-8000-0000000000${slug.length}${rows.length}`,
-    siteId,
-    leadId: null,
-    slug,
-    name: "A Project",
-    headline: null,
-    oneLiner: "A one-liner",
-    problem: "The problem",
-    url: null,
-    product: "working-prototype",
-    commitment: "part-time",
-    teamComposition: "just-me",
-    faqs: null,
-    anythingElse: null,
-    address: "1 Founder Way",
-    founderName: "Some Founder",
-    founderEmail: "founder@example.com",
-    // #5407 — a row written before the columns existed, and a freshly
-    // started draft on a site that asks for one name line: parts null,
-    // no phone, no verification stamp.
-    founderFirstName: null,
-    founderLastName: null,
-    founderPhone: null,
-    emailVerifiedAt: null,
-    founderCompany: null,
-    questions: null,
-    logoMarkUrl: null,
-    logoWordmarkUrl: null,
-    solution: null,
-    featured: false,
-    status: "active",
-    consentAt: new Date("2026-08-01T00:00:00.000Z"),
-    decidedAt: new Date("2026-09-01T00:00:00.000Z"),
-    decidedBy: "alice",
-    issueUrl: null,
-    experimentKey: null,
-    windowEndsAt: new Date("2099-01-01T00:00:00.000Z"),
-    createdAt: new Date("2026-08-01T00:00:00.000Z"),
-    updatedAt: new Date("2026-08-01T00:00:00.000Z"),
-  });
-}
-
-async function buildApp(): Promise<FastifyInstance> {
-  const app = Fastify();
-  await app.register(startProjectListingRoute);
-  await app.register(publicProjectListingsRoute);
-  await app.ready();
-  return app;
-}
-
-const start = (app: FastifyInstance, payload: Record<string, unknown>) =>
-  app.inject({ method: "POST", url: "/v1/project-listings", payload });
-
-// ─── Tests ──────────────────────────────────────────────────────────────────
-
-describe("the public site key (#5048 D2)", () => {
-  let app: FastifyInstance;
-  let savedSiteId: string | undefined;
-  let savedPublicKey: string | undefined;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    installStore();
-    // The single-tenant env path is OFF unless a test turns it on, so the
-    // config row is the only way to name a site here.
-    savedSiteId = process.env["AILK_SITE_ID"];
-    savedPublicKey = process.env["AILK_LISTING_PUBLIC_KEY"];
-    delete process.env["AILK_SITE_ID"];
-    delete process.env["AILK_LISTING_PUBLIC_KEY"];
-    // #6254 — `resolveSiteWorkspaceId()` memoizes its FIRST successful
-    // resolution for the process lifetime (by design, for the hot request
-    // path); several tests in this file change `AILK_SITE_ID` between runs,
-    // so the memo must be cleared per test or a later test would silently
-    // reuse an earlier test's resolved workspace id.
-    __resetSiteWorkspaceCacheForTests();
-    app = await buildApp();
-  });
-
-  afterEach(async () => {
-    if (savedSiteId === undefined) delete process.env["AILK_SITE_ID"];
-    else process.env["AILK_SITE_ID"] = savedSiteId;
-    if (savedPublicKey === undefined) delete process.env["AILK_LISTING_PUBLIC_KEY"];
-    else process.env["AILK_LISTING_PUBLIC_KEY"] = savedPublicKey;
-    await app.close();
-  });
-
-  // ── the refusal half ──
-
-  it("start: a body naming the site by `siteId` is REFUSED, not silently ignored", async () => {
-    const { siteKey: _siteKey, ...withoutKey } = START_PAYLOAD;
-    const res = await start(app, { ...withoutKey, siteId: SITE_A });
-
-    // `.strict()` — the old field is an unrecognised key, so this is a 400 and
-    // not a create that quietly dropped it. The distinction is the whole point:
-    // a dropped `siteId` and a refused one look the same until one of them
-    // lands somewhere.
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { ok: boolean }).ok).toBe(false);
-    expect(prisma.projectListing.create).not.toHaveBeenCalled();
-    expect(rows).toHaveLength(0);
-  });
-
-  it("start: a body carrying BOTH a valid `siteKey` and a `siteId` is refused", async () => {
-    // The one that matters. A caller holding a legitimate public key must not
-    // be able to smuggle a tenant override alongside it — if `siteId` were
-    // merely ignored this would create a draft, and the only thing standing
-    // between that and a cross-tenant write would be the resolution order in
-    // the handler.
-    const res = await start(app, { ...START_PAYLOAD, siteId: SITE_B });
-
-    expect(res.statusCode).toBe(400);
-    expect(prisma.projectListing.create).not.toHaveBeenCalled();
-    expect(rows).toHaveLength(0);
-  });
-
-  // ── the resolution half ──
-
-  it("start: a valid siteKey files the draft against THAT config row's siteId", async () => {
-    const res = await start(app, { ...START_PAYLOAD, siteKey: KEY_B });
-    expect(res.statusCode).toBe(201);
-
-    // Asserted on the STORED row, not the response: the response echoes an id
-    // and a token and would say nothing about which tenant the row landed in.
-    expect(rows).toHaveLength(1);
-    expect(rows[0]!["siteId"]).toBe(SITE_B);
-    // And the key itself is never stored as if it were the site.
-    expect(rows[0]!["siteId"]).not.toBe(KEY_B);
-  });
-
-  it("start: an UNKNOWN siteKey is a 400 `unknown_site_key` and writes no row", async () => {
-    const res = await start(app, { ...START_PAYLOAD, siteKey: "pk-nobodys-site" });
-
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { error: { code: string } }).error.code).toBe("unknown_site_key");
-    expect(prisma.projectListing.create).not.toHaveBeenCalled();
-    expect(rows).toHaveLength(0);
-  });
-
-  it("start: an unknown siteKey never FALLS BACK to the deployment's own site", async () => {
-    // The failure this guards is silent: a typo in a mounted surface's key
-    // would file one site's applications against another, with a 201 and a
-    // resume token to make it look like it worked.
-    process.env["AILK_SITE_ID"] = "the-deployments-own-site";
-    process.env["AILK_LISTING_PUBLIC_KEY"] = "pk-the-deployments-own-site";
-
-    const res = await start(app, { ...START_PAYLOAD, siteKey: "pk-typo" });
-
-    expect(res.statusCode).toBe(400);
-    expect(rows).toHaveLength(0);
-    expect(rows.some((r) => r["siteId"] === "the-deployments-own-site")).toBe(false);
-  });
-
-  it("start (single-tenant): AILK_LISTING_PUBLIC_KEY resolves to the RESOLVED currentSiteId() workspace, with no config row", async () => {
-    // The default `create-ailk` scaffold is one customer per deployment and
-    // has no `SiteListingConfig` row at all; requiring one would mean a site
-    // could not accept an application until an operator wrote a database row.
-    //
-    // #6254 AC-6/AC-10 — `siteIdForPublicKey`'s single-tenant fallback now
-    // resolves the alias (`resolveSiteWorkspaceId()`) rather than returning
-    // the raw `"default"` literal: `project_listings` rejects a `site_id`
-    // that disagrees with `workspace_id`
-    // (database/migrations/20260922120000_tenancy_fence), and the two must
-    // agree from create time.
-    process.env["AILK_LISTING_PUBLIC_KEY"] = "pk-single-tenant";
-    delete process.env["AILK_SITE_ID"]; // → currentSiteId() falls back to "default"
-    // #6335 — the "default" alias resolves through the SENTINEL workspace
-    // row, which this case (alone in the file) expects to exist.
-    mockSentinelWorkspaceExists(prisma, SITE_A, SITE_B);
-
-    const res = await start(app, { ...START_PAYLOAD, siteKey: "pk-single-tenant" });
-
-    expect(res.statusCode).toBe(201);
-    expect(rows[0]!["siteId"]).toBe(DEFAULT_WORKSPACE_ID);
-  });
-
-  it("start (single-tenant): the env key resolves to AILK_SITE_ID where one is set", async () => {
-    process.env["AILK_LISTING_PUBLIC_KEY"] = "pk-single-tenant";
-    process.env["AILK_SITE_ID"] = "the-only-site";
-    // #6335 — this case's own deployment site, named explicitly.
-    mockWorkspaceExists(prisma, SITE_A, SITE_B, "the-only-site");
-
-    const res = await start(app, { ...START_PAYLOAD, siteKey: "pk-single-tenant" });
-
-    expect(res.statusCode).toBe(201);
-    expect(rows[0]!["siteId"]).toBe("the-only-site");
-  });
-
-  // ── the same key on the public read ──
-
-  it("public: `?siteId=` is a 400 — the parameter is `siteKey` now", async () => {
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/project-listings/public?siteId=${SITE_A}`,
-    });
-
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { error: { code: string } }).error.code).toBe("validation_failed");
-  });
-
-  it("public: `?siteKey=` with a known key returns THAT site's rows and no other's", async () => {
-    seedActiveListing(SITE_A, "on-site-a");
-    seedActiveListing(SITE_B, "on-site-b");
-
-    const res = await app.inject({
-      method: "GET",
-      url: `/v1/project-listings/public?siteKey=${KEY_A}`,
-    });
-
-    expect(res.statusCode).toBe(200);
-    const slugs = (res.json() as { data: Array<{ slug: string }> }).data.map((r) => r.slug);
-    expect(slugs).toEqual(["on-site-a"]);
-    // The read is scoped by the RESOLVED id, not by the key string.
-    expect(
-      (prisma.projectListing.findMany as jest.Mock).mock.calls[0][0].where.siteId,
-    ).toBe(SITE_A);
-  });
-
-  it("public: an unknown siteKey is a 400 `unknown_site_key` and reads no rows", async () => {
-    seedActiveListing(SITE_A, "on-site-a");
-
-    const res = await app.inject({
-      method: "GET",
-      url: "/v1/project-listings/public?siteKey=pk-nobodys-site",
-    });
-
-    expect(res.statusCode).toBe(400);
-    expect((res.json() as { error: { code: string } }).error.code).toBe("unknown_site_key");
-    expect(prisma.projectListing.findMany).not.toHaveBeenCalled();
-  });
-});
-
-// ── #6203 AC-4 — the workspace stamp, and its own refusal ──────────────────
-//
-// The site-key resolution above (siteKey -> siteId) is UNCHANGED by #6203 —
-// it was already server-side and already refused a body-supplied override,
-// which the suite above already proves. What #6203 adds is a SECOND, NEW
-// resolution on top of that already-resolved siteId: siteId -> workspaceId
-// (`project-listings.ts`'s `resolveWorkspaceIdForSite`). There is no THIRD
-// body field for an attacker to spoof here (`projectListingStartSchema`
-// carries no workspaceId-shaped field at all, and the suite above already
-// proves a body-supplied `siteId` is refused outright) — so the only new
-// behaviour to assert is this second resolution's own failure mode.
-describe("the workspace stamp (#6203) — start's second resolution, on top of siteKey", () => {
-  let app: FastifyInstance;
-
-  beforeEach(async () => {
-    jest.clearAllMocks();
-    installStore();
-    delete process.env["AILK_SITE_ID"];
-    delete process.env["AILK_LISTING_PUBLIC_KEY"];
-    __resetSiteWorkspaceCacheForTests();
-    app = await buildApp();
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("a siteId that resolves via siteKey but names no workspace is a 503 tenant_unresolved, and writes no row", async () => {
-    mockNoWorkspace(prisma);
-
-    const res = await start(app, { ...START_PAYLOAD, siteKey: KEY_A });
-
-    expect(res.statusCode).toBe(503);
-    expect((res.json() as { error: { code: string } }).error.code).toBe(
-      "tenant_unresolved",
-    );
-    expect(prisma.projectListing.create).not.toHaveBeenCalled();
-    expect(rows).toHaveLength(0);
-  });
-
-  it("on resolution, the created row carries workspaceId equal to the resolved siteId", async () => {
-    const res = await start(app, { ...START_PAYLOAD, siteKey: KEY_B });
-
-    expect(res.statusCode).toBe(201);
-    expect(rows).toHaveLength(1);
-    expect(rows[0]!["siteId"]).toBe(SITE_B);
-    expect(rows[0]!["workspaceId"]).toBe(SITE_B);
-  });
-});