create-ailk 0.4.0 → 0.6.0

package/templates/apps/api/src/lib/__tests__/deliverable-asset-store.test.ts

@@ -0,0 +1,125 @@
+/**
+ * @file deliverable-asset-store.test.ts
+ * @description Unit tests for the deliverable-asset-store boundary (#6310
+ * D16) — the two scoped `Asset` reads a magnet deliverable resolution and
+ * its serve path need, modelled on `lib/asset-store.ts`'s own test shape.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- prisma is a DB boundary; __mocks__/prisma.ts activates the auto-mock (Jest requires explicit call for local files)
+jest.mock("../prisma.js");
+
+import { prisma } from "../prisma.js";
+import {
+  findDeliverableAssetIdByKey,
+  readDeliverableAsset,
+} from "../deliverable-asset-store";
+
+const WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000001";
+const OTHER_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000002";
+const ASSET_ID = "asset_00000000-0000-7000-8000-0000000000a1";
+
+describe("findDeliverableAssetIdByKey", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it("queries with exactly { workspaceId, key }", async () => {
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({ id: ASSET_ID });
+
+    const result = await findDeliverableAssetIdByKey(WORKSPACE_ID, "q3-report.pdf");
+
+    expect(prisma.asset.findFirst).toHaveBeenCalledWith({
+      where: { workspaceId: WORKSPACE_ID, key: "q3-report.pdf" },
+      select: { id: true },
+    });
+    expect(result).toBe(ASSET_ID);
+  });
+
+  it("does not return a same-key row scoped to a different workspace", async () => {
+    // The mock proves the CALL is scoped correctly; a real DB enforces the
+    // rest. This asserts the where-clause never widens to a foreign
+    // workspace even when one exists.
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
+
+    const result = await findDeliverableAssetIdByKey(
+      OTHER_WORKSPACE_ID,
+      "q3-report.pdf",
+    );
+
+    expect(prisma.asset.findFirst).toHaveBeenCalledWith({
+      where: { workspaceId: OTHER_WORKSPACE_ID, key: "q3-report.pdf" },
+      select: { id: true },
+    });
+    expect(result).toBeNull();
+  });
+
+  it("returns null on a miss", async () => {
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
+
+    const result = await findDeliverableAssetIdByKey(WORKSPACE_ID, "no-such-key");
+
+    expect(result).toBeNull();
+  });
+});
+
+describe("readDeliverableAsset", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it("queries with exactly { id, workspaceId } and selects filename/contentType/bytes", async () => {
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({
+      filename: "q3-report.pdf",
+      contentType: "application/pdf",
+      bytes: Buffer.from("PDF-BYTES"),
+    });
+
+    const result = await readDeliverableAsset(ASSET_ID, WORKSPACE_ID);
+
+    expect(prisma.asset.findFirst).toHaveBeenCalledWith({
+      where: { id: ASSET_ID, workspaceId: WORKSPACE_ID },
+      select: { filename: true, contentType: true, bytes: true },
+    });
+    expect(result).toEqual({
+      filename: "q3-report.pdf",
+      contentType: "application/pdf",
+      bytes: expect.any(Buffer),
+    });
+  });
+
+  it("returns null for a foreign-workspace id (the scoped read excludes it)", async () => {
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
+
+    const result = await readDeliverableAsset(ASSET_ID, OTHER_WORKSPACE_ID);
+
+    expect(result).toBeNull();
+  });
+
+  it("wraps the returned bytes as a Buffer view, not a copy", async () => {
+    const raw = new Uint8Array([1, 2, 3, 4]);
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({
+      filename: "f.pdf",
+      contentType: "application/pdf",
+      bytes: raw,
+    });
+
+    const result = await readDeliverableAsset(ASSET_ID, WORKSPACE_ID);
+
+    expect(Buffer.isBuffer(result?.bytes)).toBe(true);
+    expect(result?.bytes.byteOffset).toBe(raw.byteOffset);
+    expect(result?.bytes.buffer).toBe(raw.buffer);
+  });
+});
+
+describe("module boundary contract (§1.14 / D16)", () => {
+  it("exports no write, no findMany and no unscoped read", () => {
+    // The boundary's entire contract is "two named functions, nothing else
+    // reads prisma.asset" — asserted at the module surface so a future edit
+    // adding a third export or a raw prisma re-export fails this test.
+    // eslint-disable-next-line @typescript-eslint/no-var-requires -- asserting the module's own export surface
+    const mod = require("../deliverable-asset-store");
+    expect(Object.keys(mod).sort()).toEqual(
+      ["findDeliverableAssetIdByKey", "readDeliverableAsset"].sort(),
+    );
+  });
+});

package/templates/apps/api/src/lib/__tests__/error-serializer.test.ts

@@ -97,4 +97,24 @@ describe("error-serializer", () => {
     expect(body["message"]).toBeUndefined();
     expect(body["statusCode"]).toBeUndefined();
   });
+
+  // #6019 AC-2 — `pathWithoutQuery` (#5970 security review, finding 1): a
+  // route may carry its credential in the query string
+  // (`/v1/requests/:id/confirm?token=…` does), and this handler logs `path`
+  // on EVERY 5xx. A future refactor restoring the raw `request.url` must turn
+  // this red.
+  it("scrubs a query-string credential from the logged path on a 5xx", async () => {
+    await server.inject({
+      method: "GET",
+      url: "/boom?token=SUPERSECRETTOKEN",
+    });
+
+    const logged = logLines.find(
+      (line) => line["msg"] === "internal server error",
+    );
+    expect(logged?.["path"]).toBe("/boom");
+    const text = JSON.stringify(logLines);
+    expect(text).not.toContain("SUPERSECRETTOKEN");
+    expect(text).not.toContain("token=");
+  });
 });

package/templates/apps/api/src/lib/__tests__/require-commerce-claim.test.ts

@@ -0,0 +1,317 @@
+/**
+ * Unit tests for the commerce claim gate (D-64, #5796; round 2).
+ *
+ * Mocks @working-theory/license `checkLicense` and asserts the TRI-STATE
+ * contract (security review 2026-09-16, High; operator-disposed round 2):
+ *
+ *   claimed      — read successfully, features[] carries `commerce`
+ *   unclaimed    — read successfully and positively WITHOUT the claim, on a
+ *                  deployment that configures no licence at all
+ *   undetermined — the read did not establish a "no": it threw, the licence
+ *                  is revoked, a licence IS configured yet resolves free
+ *                  (expired or otherwise unverifiable), or the licence storage
+ *                  file could not be READ at all (#5820)
+ *
+ * Route behaviour differs by what is at stake, which is why this is not one
+ * response: the checkout launcher answers the module-disabled 404 on both
+ * non-serving states (a checkout that cannot start loses nothing), while the
+ * webhook receiver holds an `undetermined` event with a retryable 503 rather
+ * than dropping a charge that already happened.
+ *
+ * The tier is deliberately varied against the claim: this gate reads
+ * `features`, never `tier` (D-64).
+ */
+
+const mockCheckLicense = jest.fn();
+
+// Only `checkLicense` is stubbed. `readStoredJwtState()` runs for real against
+// a per-test fixture directory pointed at by `AILK_LICENSE_STORAGE_PATH`
+// (#5820): the absent-vs-unreadable distinction IS the thing under test, and a
+// stub of it would assert only that the stub was called — which is exactly how
+// the previous "the storage read throws" case passed against a throw the
+// package can never produce.
+jest.mock("@working-theory/license", () => ({
+  ...jest.requireActual("@working-theory/license"),
+  checkLicense: (...args: unknown[]) => mockCheckLicense(...args),
+}));
+
+import { promises as fs } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+
+import type { FastifyReply, FastifyRequest } from "fastify";
+
+import {
+  resolveCommerceClaim,
+  requireCommerceClaim,
+} from "../require-commerce-claim.js";
+
+interface StubReply {
+  statusCalled: number | null;
+  sendCalled: unknown;
+  status: jest.MockedFunction<(code: number) => StubReply>;
+  send: jest.MockedFunction<(body: unknown) => StubReply>;
+}
+
+function makeReply(): StubReply {
+  const reply: StubReply = {
+    statusCalled: null,
+    sendCalled: undefined,
+    status: jest.fn(),
+    send: jest.fn(),
+  };
+  reply.status.mockImplementation((code: number) => {
+    reply.statusCalled = code;
+    return reply;
+  });
+  reply.send.mockImplementation((body: unknown) => {
+    reply.sendCalled = body;
+    return reply;
+  });
+  return reply;
+}
+
+const logWarn = jest.fn();
+
+// The gate reads exactly one thing off the request — `log.warn`. Cast at one
+// typed boundary, the same shape require-paid-tier.test.ts uses.
+function makeRequest(): FastifyRequest {
+  // @ts-expect-error: a stub carrying only `log.warn`; a full FastifyRequest
+  // cannot be constructed without a live server instance in unit tests.
+  return { log: { warn: logWarn } };
+}
+
+const request = makeRequest();
+
+function asReply(stub: StubReply): FastifyReply {
+  // @ts-expect-error: StubReply satisfies the status+send surface requireCommerceClaim uses;
+  // a full Fastify reply cannot be constructed without a live server instance in unit tests.
+  return stub;
+}
+
+function license(overrides: Record<string, unknown> = {}) {
+  return {
+    tier: "pro",
+    plan: "pro-monthly",
+    features: [],
+    expiresAt: null,
+    revoked: false,
+    ...overrides,
+  };
+}
+
+/** The shape `checkLicense()` returns for expired, invalid AND keyless alike. */
+function freeResult() {
+  return license({ tier: "free", plan: null, features: [], revoked: false });
+}
+
+const ORIGINAL_LICENSE_KEY = process.env["AILK_LICENSE_KEY"];
+
+/** A deployment that configures a licence (env key present). */
+function withLicenceConfigured() {
+  // Presence is the whole test — the gate never parses this value, so it is
+  // deliberately not JWT-shaped (a realistic stub trips the secret scanner's
+  // entropy rule for no benefit).
+  process.env["AILK_LICENSE_KEY"] = "fixture";
+}
+
+/** A keyless deployment — no env key, and no storage file at the fixture path. */
+function withNoLicenceConfigured() {
+  delete process.env["AILK_LICENSE_KEY"];
+}
+
+// ── The storage file, for real ──────────────────────────────────────────────
+//
+// Every test points `AILK_LICENSE_STORAGE_PATH` at a fresh temp path that does
+// not exist, which is the `absent` state. The two cases below create the file
+// the package will actually read.
+
+let storageDir: string;
+let storagePath: string;
+
+/** A deployment licensed purely from the refresh storage file. */
+async function withStoredLicence() {
+  await fs.writeFile(storagePath, "stored.jwt.token", "utf8");
+}
+
+/** A storage file that exists and cannot be read — a directory at its path. */
+async function withUnreadableStorage() {
+  await fs.mkdir(storagePath);
+}
+
+beforeEach(async () => {
+  storageDir = await fs.mkdtemp(join(tmpdir(), "ailk-claim-gate-"));
+  storagePath = join(storageDir, ".ailk-license.jwt");
+  process.env["AILK_LICENSE_STORAGE_PATH"] = storagePath;
+});
+
+afterEach(async () => {
+  delete process.env["AILK_LICENSE_STORAGE_PATH"];
+  await fs.rm(storageDir, { recursive: true, force: true });
+});
+
+afterAll(() => {
+  if (ORIGINAL_LICENSE_KEY === undefined) delete process.env["AILK_LICENSE_KEY"];
+  else process.env["AILK_LICENSE_KEY"] = ORIGINAL_LICENSE_KEY;
+});
+
+describe("requireCommerceClaim (the checkout launcher's preHandler)", () => {
+  beforeEach(() => {
+    mockCheckLicense.mockReset();
+    logWarn.mockReset();
+    withNoLicenceConfigured();
+  });
+
+  it("404s the module-disabled body when features[] lacks 'commerce'", async () => {
+    mockCheckLicense.mockResolvedValue(freeResult());
+    const reply = makeReply();
+
+    await requireCommerceClaim(request, asReply(reply));
+
+    expect(reply.statusCalled).toBe(404);
+    expect(reply.sendCalled).toEqual({
+      error: "not_found",
+      message: "Not found",
+    });
+  });
+
+  it("404s a PAID tier that carries other features but not 'commerce'", async () => {
+    mockCheckLicense.mockResolvedValue(
+      license({ tier: "enterprise", features: ["docs", "multi-tenant"] }),
+    );
+    const reply = makeReply();
+
+    await requireCommerceClaim(request, asReply(reply));
+
+    expect(reply.statusCalled).toBe(404);
+  });
+
+  it("proceeds when features[] includes 'commerce'", async () => {
+    mockCheckLicense.mockResolvedValue(license({ features: ["commerce"] }));
+    const reply = makeReply();
+
+    await requireCommerceClaim(request, asReply(reply));
+
+    expect(reply.statusCalled).toBeNull();
+    expect(reply.send).not.toHaveBeenCalled();
+  });
+
+  // Round 2, D1: the checkout launcher answers the module-disabled response on
+  // BOTH non-serving states. A checkout that cannot be started loses nothing,
+  // so there is no reason to leak a "configured but unreadable" shape here —
+  // it is the webhook, where money has already moved, that holds with a 503.
+  it("404s — not 503s — on an undetermined read, because a checkout that cannot start loses nothing", async () => {
+    mockCheckLicense.mockRejectedValue(new Error("boom"));
+    const reply = makeReply();
+
+    await requireCommerceClaim(request, asReply(reply));
+
+    expect(reply.statusCalled).toBe(404);
+    expect(reply.sendCalled).toEqual({
+      error: "not_found",
+      message: "Not found",
+    });
+  });
+
+  it("404s a revoked license even while the claim is still in the JWT", async () => {
+    mockCheckLicense.mockResolvedValue(
+      license({ features: ["commerce"], revoked: true }),
+    );
+    const reply = makeReply();
+
+    await requireCommerceClaim(request, asReply(reply));
+
+    expect(reply.statusCalled).toBe(404);
+  });
+});
+
+describe("resolveCommerceClaim", () => {
+  beforeEach(() => {
+    mockCheckLicense.mockReset();
+    withNoLicenceConfigured();
+  });
+
+  it("is 'claimed' for a live license carrying the claim", async () => {
+    mockCheckLicense.mockResolvedValue(license({ features: ["commerce"] }));
+    await expect(resolveCommerceClaim()).resolves.toBe("claimed");
+  });
+
+  it("is 'unclaimed' for a license read successfully that lacks the claim", async () => {
+    mockCheckLicense.mockResolvedValue(license({ features: ["docs"] }));
+    await expect(resolveCommerceClaim()).resolves.toBe("unclaimed");
+  });
+
+  it("is 'unclaimed' on a KEYLESS build — no licence configured is a positive 'no'", async () => {
+    mockCheckLicense.mockResolvedValue(freeResult());
+    await expect(resolveCommerceClaim()).resolves.toBe("unclaimed");
+  });
+
+  // The storage-file path. `checkLicense()` resolves a licence from
+  // AILK_LICENSE_KEY *or* the refresh storage file, so a deployment can be
+  // fully licensed with no env key at all. An env-only "is a licence
+  // configured" test read that site as keyless, so its EXPIRED licence
+  // resolved `unclaimed` and its already-charged events were dropped — the
+  // same High the tri-state exists to prevent, one path over.
+  it("is 'undetermined' for an EXPIRED licence held only in the storage file", async () => {
+    delete process.env["AILK_LICENSE_KEY"];
+    mockCheckLicense.mockResolvedValue(freeResult());
+    await withStoredLicence();
+    await expect(resolveCommerceClaim()).resolves.toBe("undetermined");
+  });
+
+  it("is 'unclaimed' when neither the env key nor the storage file has a token", async () => {
+    delete process.env["AILK_LICENSE_KEY"];
+    mockCheckLicense.mockResolvedValue(freeResult());
+    await expect(resolveCommerceClaim()).resolves.toBe("unclaimed");
+  });
+
+  // #5820. Holding is the safe direction: a file that could not be READ is not
+  // evidence that a site is keyless, and dropping a signed Stripe event needs
+  // evidence. The previous version of this case stubbed `readStoredJwt()` into
+  // rejecting — a throw the package never produces, since it catches every
+  // error — so it passed while the real path acked 200 and lost the charge.
+  it("is 'undetermined' when the storage file exists and cannot be READ", async () => {
+    delete process.env["AILK_LICENSE_KEY"];
+    mockCheckLicense.mockResolvedValue(freeResult());
+    await withUnreadableStorage();
+    await expect(resolveCommerceClaim()).resolves.toBe("undetermined");
+  });
+
+  it("is 'undetermined' when the read itself throws", async () => {
+    mockCheckLicense.mockRejectedValue(new Error("boom"));
+    await expect(resolveCommerceClaim()).resolves.toBe("undetermined");
+  });
+
+  // Round 2, D1 (operator-disposed): a revoked licence is a PAYING commerce
+  // deployment inside its JWT window. Dropping its already-charged events is
+  // the same data loss the security review's High named, so it holds.
+  it("is 'undetermined' for a revoked license — a revoked site is still a live one mid-window", async () => {
+    mockCheckLicense.mockResolvedValue(
+      license({ features: ["commerce"], revoked: true }),
+    );
+    await expect(resolveCommerceClaim()).resolves.toBe("undetermined");
+  });
+
+  // Round 2, D1: an EXPIRED licence. `checkLicense()` collapses expired,
+  // invalid and keyless into one identical free result (check-license.ts
+  // returns FREE_RESULT for all three), so the only signal that separates
+  // "this site configured a licence that no longer verifies" from "this site
+  // never had one" is whether a licence is configured at all.
+  it("is 'undetermined' when a licence IS configured yet resolves free — expired or unverifiable", async () => {
+    withLicenceConfigured();
+    mockCheckLicense.mockResolvedValue(freeResult());
+    await expect(resolveCommerceClaim()).resolves.toBe("undetermined");
+  });
+
+  it("is 'claimed' for a configured licence that verifies and carries the claim", async () => {
+    withLicenceConfigured();
+    mockCheckLicense.mockResolvedValue(license({ features: ["commerce"] }));
+    await expect(resolveCommerceClaim()).resolves.toBe("claimed");
+  });
+
+  it("is 'unclaimed' for a configured licence that verifies to a paid tier without the claim", async () => {
+    withLicenceConfigured();
+    mockCheckLicense.mockResolvedValue(license({ features: ["docs"] }));
+    await expect(resolveCommerceClaim()).resolves.toBe("unclaimed");
+  });
+});