create-ailk 0.4.0 → 0.6.0

package/templates/apps/api/src/__tests__/review-surface-registration.test.ts

@@ -0,0 +1,167 @@
+/**
+ * @file review-surface-registration.test.ts
+ * @description The `multi-tenant || signal-collectors` registration matrix for
+ * the review surface (#5677).
+ *
+ * This is the TWO-SIDED check the unit turns on. `signal-collectors` (Pro) is
+ * the module that sells the instruments — flows, deliverables, project
+ * listings, waitlist experiments — so a Pro customer could collect submissions
+ * and not read them, because the review routes registered only inside the
+ * multi-tenant scope. Widening the gate has to make the Pro side work WITHOUT
+ * moving the Pro Plus side, and only exercising both builds shows that.
+ *
+ * It cannot fold into `module-exclusion.test.ts`: that suite's shape is
+ * "excluding module X 404s every route X owns", and these routes register
+ * under EITHER module, so excluding one while the other is on leaves them
+ * registered by design — the same reason `workspace-module-registration.test.ts`
+ * is its own file, whose structure this mirrors.
+ *
+ * "Resolves" is measured as "not Fastify's own 404". An unauthenticated
+ * request to a registered tenant route answers 401, never 404, so the two
+ * states are unambiguous.
+ *
+ * Mirrors `src/__tests__/server.test.ts`'s external-boundary mocks (CORS,
+ * rate-limit, email) — see that file's header for why each is mocked.
+ */
+
+jest.mock('@fastify/cors', () => {
+  return jest.fn().mockResolvedValue(undefined);
+});
+
+jest.mock('@fastify/rate-limit', () => {
+  return jest.fn().mockResolvedValue(undefined);
+});
+
+jest.mock('@working-theory/email', () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true }),
+}));
+
+import { build } from '../server';
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics; explicit any avoids pulling in the full FastifyInstance type here
+type App = any;
+
+const EXPERIMENT = 'wlx_00000000-0000-7000-8000-0000000000aa';
+
+/** The review surface — registers under EITHER module since #5677. */
+const REVIEW_ROUTES = [
+  { method: 'GET' as const, url: '/v1/waitlist-experiments' },
+  { method: 'GET' as const, url: `/v1/waitlist-experiments/${EXPERIMENT}` },
+  {
+    method: 'GET' as const,
+    url: `/v1/waitlist-experiments/${EXPERIMENT}/signups`,
+  },
+  { method: 'GET' as const, url: '/v1/project-listings' },
+];
+
+/**
+ * Organization/Workspace ADMINISTRATION — deliberately left alone by #5677,
+ * because it is not a site's own submissions. These stay multi-tenant-only.
+ */
+const MULTI_TENANT_ONLY_ROUTES = [
+  { method: 'GET' as const, url: '/v1/workspaces' },
+  { method: 'GET' as const, url: '/v1/billing' },
+];
+
+async function withEnabledModules<T>(
+  enabled: string,
+  fn: () => Promise<T>,
+): Promise<T> {
+  const prior = process.env.AILK_ENABLED_MODULES;
+  process.env.AILK_ENABLED_MODULES = enabled;
+  try {
+    return await fn();
+  } finally {
+    if (prior === undefined) {
+      delete process.env.AILK_ENABLED_MODULES;
+    } else {
+      process.env.AILK_ENABLED_MODULES = prior;
+    }
+  }
+}
+
+/** Every (method, path) pair Fastify's router holds, one per line. */
+function routeLines(app: App): string[] {
+  return (app.printRoutes({ commonPrefix: false }) as string)
+    .split('\n')
+    .map((line: string) => line.trim())
+    .filter(Boolean);
+}
+
+describe('review-surface registration matrix (#5677)', () => {
+  let app: App;
+
+  afterEach(async () => {
+    if (app) {
+      await app.close();
+      app = undefined;
+    }
+    delete process.env.AILK_ENABLED_MODULES;
+  });
+
+  it("with 'signal-collectors' alone (a Pro build), every review route resolves behind the base tenant guard", async () => {
+    app = await withEnabledModules('signal-collectors', () => build());
+
+    for (const { method, url } of REVIEW_ROUTES) {
+      const res = await app.inject({ method, url });
+      expect({ url, status: res.statusCode }).toEqual({ url, status: 401 });
+    }
+  });
+
+  it("with 'signal-collectors' alone, Organization/Workspace administration stays unregistered", async () => {
+    app = await withEnabledModules('signal-collectors', () => build());
+
+    for (const { method, url } of MULTI_TENANT_ONLY_ROUTES) {
+      const res = await app.inject({ method, url });
+      expect({ url, status: res.statusCode }).toEqual({ url, status: 404 });
+    }
+  });
+
+  it("with 'multi-tenant' alone (a Pro Plus build), every review route resolves exactly as before — the regression floor", async () => {
+    app = await withEnabledModules('multi-tenant', () => build());
+
+    for (const { method, url } of [
+      ...REVIEW_ROUTES,
+      ...MULTI_TENANT_ONLY_ROUTES,
+    ]) {
+      const res = await app.inject({ method, url });
+      expect({ url, status: res.statusCode }).not.toEqual({ url, status: 404 });
+    }
+  });
+
+  it('with BOTH enabled, each review route registers exactly once', async () => {
+    // build() itself is the first assertion: Fastify throws
+    // FST_ERR_DUPLICATED_ROUTE at registration time, so a double-registration
+    // never reaches the router tree to be counted.
+    app = await withEnabledModules('multi-tenant,signal-collectors', () =>
+      build(),
+    );
+
+    const lines = routeLines(app);
+    const experimentRoutes = lines.filter((line) =>
+      line.includes('waitlist-experiments'),
+    );
+    expect(experimentRoutes.length).toBeGreaterThan(0);
+    expect(new Set(experimentRoutes).size).toBe(experimentRoutes.length);
+
+    for (const { method, url } of [
+      ...REVIEW_ROUTES,
+      ...MULTI_TENANT_ONLY_ROUTES,
+    ]) {
+      const res = await app.inject({ method, url });
+      expect({ url, status: res.statusCode }).not.toEqual({ url, status: 404 });
+    }
+  });
+
+  it('with NEITHER enabled (a Free build), no review route registers — Free is unaffected', async () => {
+    app = await withEnabledModules('', () => build());
+
+    for (const { method, url } of [
+      ...REVIEW_ROUTES,
+      ...MULTI_TENANT_ONLY_ROUTES,
+    ]) {
+      const res = await app.inject({ method, url });
+      expect({ url, status: res.statusCode }).toEqual({ url, status: 404 });
+    }
+  });
+});

package/templates/apps/api/src/__tests__/server.test.ts

@@ -0,0 +1,471 @@
+/**
+ * @file server.test.ts
+ * @description Unit tests for server.ts - Server setup
+ *
+ * Uses the real build() function with real route plugins. All internal modules
+ * run real; external boundaries (CORS, rate-limit) are mocked at the plugin
+ * boundary since they would require live network/Redis in production.
+ */
+
+import { build, requestLogSerializer } from "../server";
+
+// External service boundaries — mocked because they require live infrastructure
+// or have ESM-only transitive deps that Jest's CJS preset cannot resolve:
+//   @fastify/cors, @fastify/rate-limit — Fastify plugins that would require
+//     live network infrastructure (CORS policy sync, Redis store) in unit tests.
+//   @working-theory/email — transitive dep on @react-email/components which is ESM-only
+//     and cannot be resolved by jest-resolve in CommonJS mode.
+jest.mock("@fastify/cors", () => {
+  return jest.fn().mockResolvedValue(undefined);
+});
+
+jest.mock("@fastify/rate-limit", () => {
+  return jest.fn().mockResolvedValue(undefined);
+});
+
+jest.mock("@working-theory/email", () => ({
+  sendLeadNotification: jest.fn().mockResolvedValue({ ok: true }),
+}));
+
+describe("Server", () => {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- server is typed via Fastify generics; explicit any avoids pulling in the full FastifyInstance type here
+  let app: any;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+  });
+
+  afterEach(async () => {
+    if (app) {
+      await app.close();
+    }
+  });
+
+  describe("build function", () => {
+    it("should build Fastify server instance", async () => {
+      // ACT
+      app = await build();
+
+      // ASSERT
+      expect(app).toBeDefined();
+      expect(typeof app.inject).toBe("function");
+    });
+
+    it("should register health check route returning static OK without external calls", async () => {
+      // ARRANGE
+      app = await build();
+
+      // ACT
+      const response = await app.inject({
+        method: "GET",
+        url: "/health",
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(200);
+      const body = JSON.parse(response.body);
+      expect(body.status).toBe("healthy");
+      expect(body.timestamp).toBeDefined();
+      // No external dependencies in the health check anymore
+      expect(body.platform).toBeUndefined();
+    });
+
+    it("should register root endpoint", async () => {
+      // ARRANGE
+      app = await build();
+
+      // ACT
+      const response = await app.inject({
+        method: "GET",
+        url: "/",
+      });
+
+      // ASSERT
+      expect(response.statusCode).toBe(200);
+      const body = JSON.parse(response.body);
+      expect(body.name).toBe("AI Launch Kit API");
+      expect(body.endpoints).toBeDefined();
+    });
+
+    it("should register CORS", async () => {
+      // ACT
+      app = await build();
+
+      // ASSERT - CORS should be registered (no error thrown)
+      expect(app).toBeDefined();
+    });
+
+    it("should register all route plugins", async () => {
+      // ARRANGE
+      app = await build();
+
+      // ACT & ASSERT - Test that routes are registered by checking they don't 404
+      const healthResponse = await app.inject({
+        method: "GET",
+        url: "/health",
+      });
+      expect(healthResponse.statusCode).toBe(200);
+
+      const rootResponse = await app.inject({
+        method: "GET",
+        url: "/",
+      });
+      expect(rootResponse.statusCode).toBe(200);
+    });
+
+    it("should include all endpoints in root response", async () => {
+      // ARRANGE
+      app = await build();
+
+      // ACT
+      const response = await app.inject({
+        method: "GET",
+        url: "/",
+      });
+
+      // ASSERT
+      const body = JSON.parse(response.body);
+      expect(body.endpoints).toHaveProperty("health");
+      expect(body.endpoints).toHaveProperty("tokens");
+      expect(body.endpoints).toHaveProperty("profile");
+    });
+
+    it("startup throws when LEAD_CAPTURE_FILE points at a missing directory", async () => {
+      // ARRANGE — set LEAD_CAPTURE_FILE to a path whose parent dir doesn't exist
+      // so the real validateLeadCaptureDir() throws (AC8). Restore after test.
+      const prior = process.env.LEAD_CAPTURE_FILE;
+      process.env.LEAD_CAPTURE_FILE = "/nonexistent-ailk-test-dir/leads.jsonl";
+
+      try {
+        // ACT & ASSERT
+        await expect(build()).rejects.toThrow(/LEAD_CAPTURE_FILE/);
+      } finally {
+        if (prior === undefined) {
+          delete process.env.LEAD_CAPTURE_FILE;
+        } else {
+          process.env.LEAD_CAPTURE_FILE = prior;
+        }
+      }
+    });
+  });
+});
+
+// ── Bootstrap test: raw-body parser scope encapsulation (AC 13) ──────────────
+//
+// Proves that registering the webhooks plugin (with its raw-body parser scoped
+// to application/json) does NOT leak that parser to other routes. The global
+// Fastify JSON parser must remain active for all non-webhook routes.
+
+import Fastify from "fastify";
+import { webhooksRoutes } from "../routes/webhooks/index.js";
+
+describe("Parser scope — webhooks raw-body parser does not leak", () => {
+  it("other routes still receive parsed JSON objects after webhooks plugin registers", async () => {
+    // Build a minimal server that mirrors the encapsulation pattern in server.ts:
+    //   1. Register a JSON route that echoes the parsed body.
+    //   2. Register the webhooks plugin inside an encapsulated scope with a
+    //      raw-body (buffer) parser.
+    // If the raw-body parser leaks out of the webhooks scope, the echo route
+    // would receive a Buffer instead of a parsed object.
+
+    const server = Fastify({ logger: false });
+
+    // A simple JSON echo route — simulates any existing JSON-parsed route
+    server.post("/api/echo", async (req) => ({ received: req.body }));
+
+    // Mirror of server.ts registration pattern
+    await server.register(async (webhooksScope) => {
+      webhooksScope.addContentTypeParser(
+        "application/json",
+        { parseAs: "buffer" },
+        (_req, body, done) => {
+          done(null, body);
+        },
+      );
+      await webhooksScope.register(webhooksRoutes);
+    });
+
+    await server.ready();
+
+    try {
+      const response = await server.inject({
+        method: "POST",
+        url: "/api/echo",
+        payload: { hello: "world" },
+        headers: { "content-type": "application/json" },
+      });
+
+      expect(response.statusCode).toBe(200);
+      const body = JSON.parse(response.body);
+      // Must be a plain object, not a stringified Buffer
+      expect(body.received).toEqual({ hello: "world" });
+      expect(Buffer.isBuffer(body.received)).toBe(false);
+    } finally {
+      await server.close();
+    }
+  });
+
+  describe("per-scope rate-limit defaults (#5111, DEF-004)", () => {
+    // Real end-to-end behavior against the real in-house rate-limit
+    // middleware (NOT mocked — this repo's convention is to mock only real
+    // external boundaries, never an internal module, see the file header).
+    // aeoScope's `/v1/aeo/score/example` needs no DB/network (a bundled
+    // example, `loadExampleScore()`); flowsScope's `/v1/flows/:slug` with a
+    // schema-invalid slug returns 400 before any DB access — both let the
+    // onRequest rate-limit hook be the only thing under test, regardless of
+    // the eventual handler status.
+    it("caps aeoScope at the strict pre-#4730 default (10/min) — the 11th request 429s", async () => {
+      app = await build();
+      const ip = "198.51.100.11";
+
+      for (let i = 0; i < 10; i++) {
+        const res = await app.inject({
+          method: "GET",
+          url: "/v1/aeo/score/example",
+          headers: { "x-forwarded-for": ip },
+        });
+        expect(res.statusCode).not.toBe(429);
+      }
+
+      const eleventh = await app.inject({
+        method: "GET",
+        url: "/v1/aeo/score/example",
+        headers: { "x-forwarded-for": ip },
+      });
+      expect(eleventh.statusCode).toBe(429);
+    });
+
+    it("leaves flowsScope above the strict default — 11 requests never 429", async () => {
+      // #5366 (D-48): /v1/flows/:slug only registers when signal-collectors
+      // is enabled.
+      const prior = process.env.AILK_ENABLED_MODULES;
+      process.env.AILK_ENABLED_MODULES = "signal-collectors";
+      try {
+        app = await build();
+        const ip = "198.51.100.12";
+
+        for (let i = 0; i < 11; i++) {
+          const res = await app.inject({
+            method: "GET",
+            url: "/v1/flows/not-a-real-slug!!!",
+            headers: { "x-forwarded-for": ip },
+          });
+          // Schema-invalid slug → 400, well before any rate limit or DB call.
+          expect(res.statusCode).toBe(400);
+        }
+      } finally {
+        if (prior === undefined) {
+          delete process.env.AILK_ENABLED_MODULES;
+        } else {
+          process.env.AILK_ENABLED_MODULES = prior;
+        }
+      }
+    });
+  });
+});
+
+// ── #5970 — the request log must never carry a query string ────────────────
+//
+// The security review's High finding: a bare `logger: true` gives pino's stock
+// `req` serializer, which logs `req.raw.url` VERBATIM — so every open of
+// `/v1/requests/:id/confirm?token=…` wrote a live seven-day credential into
+// the log drain, from a hook that fires before any route-level code can
+// intervene. The four fixes for that finding shipped with no assertion between
+// them, which is precisely how this class of bug comes back: a future refactor
+// restores `request.url` and nothing turns red.
+//
+// Asserted both ways — the serializer's own output, and a real captured line,
+// so neither the function nor its WIRING can regress unnoticed.
+describe("#5970 — the request log carries no query string", () => {
+  const asRequest = (url: string) =>
+    ({
+      url,
+      method: "GET",
+      hostname: "api.example.com",
+      ip: "203.0.113.1",
+    }) as never;
+
+  it("drops the query string but keeps the path and its route parameters", () => {
+    expect(
+      requestLogSerializer(
+        asRequest("/v1/requests/callbk_1/confirm?token=SUPERSECRETTOKEN"),
+      ),
+    ).toEqual({
+      method: "GET",
+      url: "/v1/requests/callbk_1/confirm",
+      host: "api.example.com",
+      remoteAddress: "203.0.113.1",
+    });
+  });
+
+  it("leaves a URL with no query exactly as it is", () => {
+    expect(requestLogSerializer(asRequest("/health")).url).toBe("/health");
+  });
+
+  it("is actually wired into the instance — a captured line carries no token", async () => {
+    const lines: string[] = [];
+    const fastify = require("fastify")({
+      logger: {
+        level: "info",
+        serializers: { req: requestLogSerializer },
+        stream: { write: (msg: string) => lines.push(msg) },
+      },
+    });
+    fastify.get("/v1/requests/:id/confirm", async () => ({ ok: true }));
+    await fastify.ready();
+    try {
+      await fastify.inject({
+        method: "GET",
+        url: "/v1/requests/callbk_1/confirm?token=SUPERSECRETTOKEN",
+      });
+      const captured = lines.join("\n");
+      expect(captured).toContain("/v1/requests/callbk_1/confirm");
+      expect(captured).not.toContain("SUPERSECRETTOKEN");
+      expect(captured).not.toContain("token=");
+    } finally {
+      await fastify.close();
+    }
+  });
+});
+
+// #6084 D14/AC-9 — `GET /v1/checkout/sessions/:id` puts its credential in
+// the PATH, which the #5970 query-string strip above does not cover. A
+// `cs_…`-shaped PATH SEGMENT is truncated to its first 8 characters plus
+// `…`; the rule is segment-scoped so it cannot corrupt an unrelated URL.
+describe("#6084 D14 — a cs_… path segment is truncated to 8 characters", () => {
+  const asRequest = (url: string) =>
+    ({
+      url,
+      method: "GET",
+      hostname: "api.example.com",
+      ip: "203.0.113.1",
+    }) as never;
+
+  it("truncates a cs_… session id segment to its first 8 characters plus an ellipsis", () => {
+    expect(
+      requestLogSerializer(
+        asRequest(
+          "/v1/checkout/sessions/cs_test_a1B2c3D4e5F6g7H8i9J0",
+        ),
+      ),
+    ).toEqual({
+      method: "GET",
+      url: "/v1/checkout/sessions/cs_test_…",
+      host: "api.example.com",
+      remoteAddress: "203.0.113.1",
+    });
+  });
+
+  it("leaves an unrelated path byte-identical to today (no cs_ segment present)", () => {
+    expect(requestLogSerializer(asRequest("/v1/checkout/sessions")).url).toBe(
+      "/v1/checkout/sessions",
+    );
+  });
+
+  it("does not truncate a segment that merely CONTAINS cs_ mid-string, only one that IS cs_…-shaped", () => {
+    expect(
+      requestLogSerializer(asRequest("/v1/content/discs_catalog")).url,
+    ).toBe("/v1/content/discs_catalog");
+  });
+
+  it("is actually wired into the instance — a captured line carries no full session id", async () => {
+    const lines: string[] = [];
+    const fastify = require("fastify")({
+      logger: {
+        level: "info",
+        serializers: { req: requestLogSerializer },
+        stream: { write: (msg: string) => lines.push(msg) },
+      },
+    });
+    fastify.get("/v1/checkout/sessions/:id", async () => ({ ok: true }));
+    await fastify.ready();
+    try {
+      await fastify.inject({
+        method: "GET",
+        url: "/v1/checkout/sessions/cs_test_a1B2c3D4e5F6g7H8i9J0",
+      });
+      const captured = lines.join("\n");
+      expect(captured).toContain("/v1/checkout/sessions/cs_test_…");
+      expect(captured).not.toContain(
+        "cs_test_a1B2c3D4e5F6g7H8i9J0",
+      );
+    } finally {
+      await fastify.close();
+    }
+  });
+});
+
+// #6216 D11/§ 9 A-3 — the SAME rule's second arm: a `lead_…`-shaped PATH
+// SEGMENT (every item read / PATCH under `/v1/workspaces/:id/messages/:leadId`)
+// is truncated to 8 characters plus `…`, exactly like the `cs_` case above.
+// The `cs_…` behaviour must stay byte-identical (asserted in the SAME test).
+describe("#6216 D11 — a lead_… path segment is truncated to 8 characters, cs_ unchanged", () => {
+  const LEAD_ID = "lead_01928374-65ba-7cde-89ab-0123456789ab";
+
+  const asRequest = (url: string) =>
+    ({
+      url,
+      method: "GET",
+      hostname: "api.example.com",
+      ip: "203.0.113.1",
+    }) as never;
+
+  it("truncates a lead_… id segment to its first 8 characters plus an ellipsis", () => {
+    expect(
+      requestLogSerializer(
+        asRequest(`/v1/workspaces/wksp_00000000-0000-7000-8000-000000000001/messages/${LEAD_ID}`),
+      ),
+    ).toEqual({
+      method: "GET",
+      url: "/v1/workspaces/wksp_00000000-0000-7000-8000-000000000001/messages/lead_019…",
+      host: "api.example.com",
+      remoteAddress: "203.0.113.1",
+    });
+  });
+
+  it("leaves the list path (no :leadId segment) byte-identical to today", () => {
+    expect(
+      requestLogSerializer(
+        asRequest(
+          "/v1/workspaces/wksp_00000000-0000-7000-8000-000000000001/messages",
+        ),
+      ).url,
+    ).toBe(
+      "/v1/workspaces/wksp_00000000-0000-7000-8000-000000000001/messages",
+    );
+  });
+
+  it("the cs_… behaviour is byte-identical after adding the lead_ arm", () => {
+    expect(
+      requestLogSerializer(
+        asRequest("/v1/checkout/sessions/cs_test_a1B2c3D4e5F6g7H8i9J0"),
+      ).url,
+    ).toBe("/v1/checkout/sessions/cs_test_…");
+  });
+
+  it("is actually wired into the instance — a captured line carries no full lead id", async () => {
+    const lines: string[] = [];
+    const fastify = require("fastify")({
+      logger: {
+        level: "info",
+        serializers: { req: requestLogSerializer },
+        stream: { write: (msg: string) => lines.push(msg) },
+      },
+    });
+    fastify.get("/v1/workspaces/:workspaceId/messages/:leadId", async () => ({
+      ok: true,
+    }));
+    await fastify.ready();
+    try {
+      await fastify.inject({
+        method: "GET",
+        url: `/v1/workspaces/wksp_00000000-0000-7000-8000-000000000001/messages/${LEAD_ID}`,
+      });
+      const captured = lines.join("\n");
+      expect(captured).toContain("/messages/lead_019…");
+      expect(captured).not.toContain(LEAD_ID);
+    } finally {
+      await fastify.close();
+    }
+  });
+});

package/templates/apps/api/src/__tests__/vercel-handler.test.ts

@@ -368,3 +368,48 @@ describe('vercel-handler — one build per process (#5332)', () => {
     expect(sentMessage(res)).toBe('Server build failed: Server initialization timeout after 10s');
   });
 });
+
+// #6019 AC-2 — the PATHNAME, never the raw target (#5970 security review
+// round 2, H1): this is the first log line the production entry point emits,
+// ahead of Fastify's own query-stripped one, so a route parameter's
+// credential in the query string (`/v1/requests/:id/confirm?token=…`) must
+// never reach it.
+describe('vercel-handler — the request log carries no query string (#5970)', () => {
+  beforeEach(() => {
+    jest.resetModules();
+  });
+
+  it('logs the pathname, not the raw target, on request start', async () => {
+    const inject = jest.fn().mockResolvedValue({
+      statusCode: 200,
+      headers: {},
+      body: 'ok',
+      rawPayload: Buffer.from('ok'),
+    });
+    jest.doMock('../server', () => ({ build: jest.fn().mockResolvedValue({ inject }) }));
+    const handler = loadHandler();
+
+    const req: MockVercelRequest = {
+      method: 'GET',
+      url: '/v1/requests/callbk_1/confirm?token=SUPERSECRETTOKEN',
+      headers: {},
+      body: undefined,
+      query: { token: 'SUPERSECRETTOKEN' },
+    };
+    const res = makeRes();
+
+    await handler(asRequest(req), asResponse(res));
+
+    const { logger } = require('@working-theory/observability') as {
+      logger: { info: jest.Mock };
+    };
+    const startCall = logger.info.mock.calls.find(
+      ([, msg]) => msg === '[Vercel Handler] Starting request',
+    );
+    expect(startCall?.[0]).toEqual({
+      method: 'GET',
+      pathname: '/v1/requests/callbk_1/confirm',
+    });
+    expect(JSON.stringify(logger.info.mock.calls)).not.toContain('SUPERSECRETTOKEN');
+  });
+});