create-ailk 0.4.0 → 0.6.0

package/templates/apps/api/src/routes/leads/__tests__/list.test.ts

@@ -0,0 +1,171 @@
+/**
+ * @file list.test.ts
+ * Route-level inject tests for `GET /v1/leads` (#5678).
+ *
+ * The scoping proof lives one layer down, in
+ * `src/services/__tests__/leads-inbox.test.ts` — it seeds two sites against a
+ * realistically filtering prisma mock and asserts a caller for one reads none
+ * of the other's. This file covers what only the HTTP boundary can show: that
+ * an unauthenticated caller is refused before the service is ever reached,
+ * that the scope cannot be widened from the query string, and that the
+ * envelope and the 400 mapping are what `apps/api/CLAUDE.md` specifies.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- the service is this route's own collaborator; mocking it keeps these tests on the HTTP boundary (the scoping proof is the service's own test).
+jest.mock("../../../services/leads-inbox.js", () => ({
+  listOwnedLeads: jest.fn(),
+}));
+
+import type { FastifyInstance } from "fastify";
+
+import { listOwnedLeads } from "../../../services/leads-inbox.js";
+import { leadListRoute } from "../list";
+
+const listOwnedLeadsMock = listOwnedLeads as jest.Mock;
+
+const USER_ID = "user_00000000-0000-7000-8000-0000000000a1";
+const PAGE = {
+  items: [
+    {
+      id: "lead_00000000-0000-7000-8000-0000000000d1",
+      name: "Ada Lovelace",
+      email: "ada@example.com",
+      source: "web",
+      createdAt: "2026-09-15T12:00:00.000Z",
+    },
+  ],
+  nextCursor: null,
+};
+
+/**
+ * Builds the route with `request.userId` pre-set, standing in for the
+ * `authPreHandlerPlugin` that decorates it in `server.ts`'s `authScope`.
+ * `userId: undefined` is the anonymous case — the same state the decorator
+ * leaves behind when no session resolves.
+ */
+async function buildApp(userId: string | undefined): Promise<FastifyInstance> {
+  const fastify = require("fastify")();
+  fastify.decorateRequest("userId", undefined);
+  fastify.addHook("onRequest", (request: { userId?: string }, _reply: unknown, done: () => void) => {
+    request.userId = userId;
+    done();
+  });
+  await fastify.register(leadListRoute);
+  return fastify;
+}
+
+describe("GET /v1/leads", () => {
+  let app: FastifyInstance;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    listOwnedLeadsMock.mockResolvedValue({ ok: true, value: PAGE });
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("401s an unauthenticated caller without touching the read service", async () => {
+    app = await buildApp(undefined);
+
+    const res = await app.inject({ method: "GET", url: "/v1/leads" });
+
+    expect(res.statusCode).toBe(401);
+    expect(res.json()).toEqual({
+      ok: false,
+      error: { code: "unauthorized", message: "Authentication required" },
+    });
+    expect(listOwnedLeadsMock).not.toHaveBeenCalled();
+  });
+
+  it("returns the page in the { ok: true, data } envelope", async () => {
+    app = await buildApp(USER_ID);
+
+    const res = await app.inject({ method: "GET", url: "/v1/leads" });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({ ok: true, data: PAGE });
+    expect(listOwnedLeadsMock).toHaveBeenCalledWith({
+      userId: USER_ID,
+      cursor: undefined,
+      limit: 50,
+    });
+  });
+
+  it("ignores a caller-supplied siteId — the scope cannot be widened from the wire", async () => {
+    app = await buildApp(USER_ID);
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/leads?siteId=someone-elses-site&workspaceId=another",
+    });
+
+    expect(res.statusCode).toBe(200);
+    // The service is called with the caller's identity and the paging
+    // parameters only — no site, org or workspace value reaches it.
+    expect(listOwnedLeadsMock).toHaveBeenCalledWith({
+      userId: USER_ID,
+      cursor: undefined,
+      limit: 50,
+    });
+  });
+
+  it("400s a malformed cursor before any read", async () => {
+    app = await buildApp(USER_ID);
+
+    const res = await app.inject({ method: "GET", url: "/v1/leads?cursor=not-a-lead-id" });
+
+    expect(res.statusCode).toBe(400);
+    expect(res.json().error.code).toBe("validation_failed");
+    expect(listOwnedLeadsMock).not.toHaveBeenCalled();
+  });
+
+  it("400s a limit above the 200 ceiling", async () => {
+    app = await buildApp(USER_ID);
+
+    const res = await app.inject({ method: "GET", url: "/v1/leads?limit=1000" });
+
+    expect(res.statusCode).toBe(400);
+    expect(listOwnedLeadsMock).not.toHaveBeenCalled();
+  });
+
+  it("maps the service's invalid_cursor to a 400, not a 404 or a silent page 1", async () => {
+    app = await buildApp(USER_ID);
+    listOwnedLeadsMock.mockResolvedValue({
+      ok: false,
+      error: { kind: "invalid_cursor", message: "cursor does not resolve within this scope" },
+    });
+
+    const res = await app.inject({
+      method: "GET",
+      url: "/v1/leads?cursor=lead_00000000-0000-7000-8000-0000000000d9",
+    });
+
+    expect(res.statusCode).toBe(400);
+    expect(res.json()).toEqual({
+      ok: false,
+      error: {
+        code: "validation_failed",
+        message: "cursor does not resolve within this scope",
+      },
+    });
+  });
+
+  it("500s an internal error without surfacing its detail", async () => {
+    app = await buildApp(USER_ID);
+    listOwnedLeadsMock.mockResolvedValue({
+      ok: false,
+      error: { kind: "internal_error", message: "connect ECONNREFUSED 127.0.0.1:5432" },
+    });
+
+    const res = await app.inject({ method: "GET", url: "/v1/leads" });
+
+    expect(res.statusCode).toBe(500);
+    expect(res.json()).toEqual({
+      ok: false,
+      error: { code: "internal_error", message: "Failed to read leads" },
+    });
+    expect(res.body).not.toContain("ECONNREFUSED");
+  });
+});

package/templates/apps/api/src/routes/leads/index.ts

@@ -5,16 +5,32 @@
  *   POST /v1/leads/submit    — lead submission (contact form / inquiry)
  *   POST /v1/leads/subscribe — newsletter subscription
  *   POST /v1/leads/callback  — callback request (phone-back)
+ *
+ * TENANT RESOLUTION (#6203, spec §10.4 operator ruling — reverses this
+ * file's former byte-unchanged posture). `siteId` used to be taken VERBATIM
+ * from the request body (`body["siteId"] as string`) — an anonymous, no-
+ * ownership-check value (`packages/validation/src/schemas/leads.ts`'s
+ * `safeSiteIdString` permits a `wksp_<uuidv7>`-shaped literal). Every
+ * capture kind now resolves its tenant SERVER-SIDE, via
+ * `resolveSiteWorkspaceId()` (`lib/site.ts`) — the SAME alias -> workspace
+ * resolution `currentSiteId()`/`AILK_SITE_ID` already drive throughout this
+ * app, unconditional on the content adapter — and a client-posted `siteId`
+ * is IGNORED entirely: it can no longer place a row anywhere. An unresolved
+ * result (no DATABASE_URL, or the alias names no workspace this database
+ * holds) is a 503 before any write is attempted — never a guess. See
+ * `lead-routing.ts`'s own header for the persistence-side half.
  */
 
 import { track } from "@working-theory/analytics/server";
 import type { FastifyPluginAsync } from "fastify";
 
+import { currentSiteId, resolveSiteWorkspaceId } from "../../lib/site.js";
 import {
   type LeadKind,
   type RouteLeadInput,
   routeLead,
 } from "../../services/lead-routing.js";
+import { sendRequestConfirmLink } from "../../services/request-confirm.js";
 
 /**
  * Read a named string field from the body, falling back to the same-named
@@ -42,17 +58,22 @@ function liftString(
  * `email`/`name`/`phone` out of `payload` (see liftString above) reads by
  * explicit field name only — it does not spread `payload`'s other keys, so
  * the same discipline holds. `payload` itself is passed through unchanged.
+ *
+ * `siteId` is the RESOLVED `workspaceId` (#6203) — never `body["siteId"]`.
+ * A body-supplied `siteId` is read nowhere in this function; a client that
+ * posts one has it silently ignored, never honoured.
  */
 function buildInput(
   kind: LeadKind,
   body: Record<string, unknown>,
+  workspaceId: string,
 ): RouteLeadInput {
   const payload = (body["payload"] ?? {}) as Record<string, unknown>;
 
   if (kind === "submit") {
     return {
       kind,
-      siteId: body["siteId"] as string,
+      siteId: workspaceId,
       source: body["source"] as string,
       email: liftString(body, payload, "email"),
       payload,
@@ -61,14 +82,14 @@ function buildInput(
   if (kind === "subscribe") {
     return {
       kind,
-      siteId: body["siteId"] as string,
+      siteId: workspaceId,
       email: liftString(body, payload, "email"),
       source: body["source"] as string,
     };
   }
   return {
     kind,
-    siteId: body["siteId"] as string,
+    siteId: workspaceId,
     name: liftString(body, payload, "name"),
     phone: liftString(body, payload, "phone"),
     ...(body["preferredTime"] !== undefined && {
@@ -99,7 +120,46 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
         receivedAt: new Date().toISOString(),
       };
 
-      const result = await routeLead(buildInput(kind, body), sourceMeta);
+      // #6203 — resolve the tenant SERVER-SIDE before any write is
+      // attempted. Two branches, deliberately different:
+      //
+      //  - No DATABASE_URL: the zero-config OSS file-fallback deployment.
+      //    There is no `workspaces` table to resolve against (and
+      //    `assertSiteAliasResolves()` already skips its own boot check for
+      //    exactly this reason), so the "resolved" value here is the site
+      //    ALIAS itself (`currentSiteId()`) — the same value the file
+      //    fallback would have carried before this unit. Never a rejection:
+      //    that would break lead capture for every zero-config scaffold.
+      //  - DATABASE_URL set: resolve via `resolveSiteWorkspaceId()`, the
+      //    SAME alias -> workspace resolution `currentSiteId()` already
+      //    drives everywhere else in this app. `null` here is a genuine
+      //    misconfiguration `build()` already refuses to boot past
+      //    (`assertSiteAliasResolves()`) — reaching it at request time is
+      //    the residual case that startup check cannot catch (a workspace
+      //    deleted after boot, a transient read), and it fails closed the
+      //    same way: reject, never guess (spec AC-4).
+      let workspaceId: string;
+      if (!process.env.DATABASE_URL) {
+        workspaceId = currentSiteId();
+      } else {
+        const resolved = await resolveSiteWorkspaceId();
+        if (resolved === null) {
+          request.log.error(
+            { kind },
+            "lead capture: DATABASE_URL is set but the site alias resolves to no workspace",
+          );
+          return reply.status(503).send({
+            error: "tenant_unresolved",
+            message: "This site is not configured to accept submissions.",
+          });
+        }
+        workspaceId = resolved;
+      }
+
+      const result = await routeLead(
+        buildInput(kind, body, workspaceId),
+        sourceMeta,
+      );
 
       if (!result.ok) {
         if (result.error.kind === "invalid_input") {
@@ -110,7 +170,7 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
         if (result.error.kind === "persist_failed") {
           // Do not surface internal error detail — log it server-side only
           request.log.error(
-            { kind, siteId: body["siteId"], error: result.error.message },
+            { kind, siteId: workspaceId, error: result.error.message },
             "lead persist_failed",
           );
           return reply.status(503).send({ error: "persist_failed" });
@@ -131,7 +191,7 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
             : "error";
       request.log.info(
         {
-          siteId: body["siteId"],
+          siteId: workspaceId,
           kind,
           ip: sourceMeta.ip,
           persisted: result.persisted,
@@ -140,6 +200,35 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
         "lead routed",
       );
 
+      // Request-and-confirm (#5970): mint the tenant's one-time confirm
+      // credential and email them the link. Fire-and-forget and `void`-
+      // returning, so the 201 below stays independent of both Resend and that
+      // write — the request is already persisted by this point, and a send
+      // that fails must never turn a captured lead into an error.
+      //
+      // Callback only: `submit` and `subscribe` have no confirm step. The
+      // service itself no-ops (with a logged reason) when the feature is not
+      // configured, which is the default.
+      // `result.persisted === "db"` for the same reason `lead-routing.ts`
+      // consults it (#5970 security review round 3, M1): the credential is
+      // minted by an update on the `callbacks` row, so a FILE-FALLBACK id
+      // would match nothing and the operator would be left with no email at
+      // all. On that path the generic notification is sent instead, which is
+      // what keeps "exactly one" true in both directions.
+      if (kind === "callback" && result.persisted === "db") {
+        const callbackInput = buildInput(kind, body, workspaceId) as Extract<
+          RouteLeadInput,
+          { kind: "callback" }
+        >;
+        sendRequestConfirmLink(result.id, {
+          name: callbackInput.name,
+          phone: callbackInput.phone,
+          ...(callbackInput.preferredTime !== undefined && {
+            preferredTime: callbackInput.preferredTime,
+          }),
+        });
+      }
+
       // Fire-and-forget: track() never throws; no need to hold the response.
       void track("lead-captured", {
         source: body["source"] as string | undefined,
@@ -148,13 +237,11 @@ function makeLeadsRoute(kind: LeadKind): FastifyPluginAsync {
         ] as string | undefined,
       });
 
-      return reply
-        .status(201)
-        .send({
-          id: result.id,
-          persisted: result.persisted,
-          email: result.email,
-        });
+      return reply.status(201).send({
+        id: result.id,
+        persisted: result.persisted,
+        email: result.email,
+      });
     });
   };
 }

package/templates/apps/api/src/routes/leads/list.ts

@@ -0,0 +1,104 @@
+/**
+ * The leads INBOX read (#5678).
+ *
+ * Routes:
+ *   GET /v1/leads?cursor=&limit=  — the caller's own sites' leads, newest first
+ *
+ * Registered INSIDE `server.ts`'s `authScope` (auth only — NOT the inner
+ * `tenantScope`, which the multi-tenant module owns), beside
+ * `/v1/waitlist-signups/me` and `/v1/project-listings/me`. Lead capture is a
+ * never-gate surface at every level, so reading a lead back must be too: this
+ * route is registered unconditionally, not behind an `isModuleEnabled()` gate.
+ * Registering everywhere is not the same as RETURNING a row everywhere —
+ * `services/leads-inbox.ts` § "What it takes for this to return anything"
+ * names the two deployment preconditions, both of which fail empty, never
+ * wide.
+ *
+ * Identity is `request.userId` ONLY. There is no site, org or workspace
+ * parameter — the query schema declares `cursor` and `limit` and nothing else
+ * — so the scope cannot be widened from the wire. `services/leads-inbox.ts`
+ * resolves it from the caller's own memberships through
+ * `services/owner-workspaces.ts`'s `resolveOwnerWorkspaces` and filters every
+ * read on `siteId ∈ workspaceIds`.
+ *
+ * Envelope per apps/api/CLAUDE.md: `{ ok: true, data }` /
+ * `{ ok: false, error: { code, message } }`, real HTTP status codes:
+ *   400 validation_failed · 401 unauthorized · 500 internal_error.
+ *
+ * No response-contract re-parse (the `waitlist-experiments/respond.ts`
+ * `sendValidated` net): the five fields of a row are assembled one by one in
+ * `leads-inbox.ts` from five explicitly selected columns, with no
+ * pass-through of a stored value that could carry an unexpected shape — so
+ * there is no drift for that net to catch.
+ *
+ * API↔MCP parity: identity-bound (the session IS the scope; the OSS MCP
+ * surface is identity-blind) — no MCP twin (#3591 exception, the same shape as
+ * `/v1/workspaces/*`, `/v1/billing/*` and `/v1/waitlist-experiments/*`).
+ */
+import { zLeadId } from "@working-theory/ids";
+import type { FastifyPluginAsync, FastifyReply } from "fastify";
+import { z } from "zod";
+
+import { listOwnedLeads } from "../../services/leads-inbox.js";
+
+const DEFAULT_LIMIT = 50;
+const MAX_LIMIT = 200;
+
+const emptyToUndefined = (val: unknown) => (val === "" ? undefined : val);
+
+/** Boundary validation, mirroring `waitlist-experiments/signups.ts`'s query schema. */
+const listQuerySchema = z.object({
+  cursor: z.preprocess(emptyToUndefined, zLeadId.optional()),
+  limit: z.preprocess(
+    emptyToUndefined,
+    z.coerce.number().int().min(1).max(MAX_LIMIT).optional(),
+  ),
+});
+
+function unauthorized(reply: FastifyReply) {
+  return reply.status(401).send({
+    ok: false,
+    error: { code: "unauthorized", message: "Authentication required" },
+  });
+}
+
+function invalidQuery(reply: FastifyReply, message: string) {
+  return reply.status(400).send({
+    ok: false,
+    error: { code: "validation_failed", message },
+  });
+}
+
+export const leadListRoute: FastifyPluginAsync = async (fastify) => {
+  fastify.get("/v1/leads", async (request, reply) => {
+    const userId = request.userId;
+    if (!userId) return unauthorized(reply);
+
+    const query = listQuerySchema.safeParse(request.query);
+    if (!query.success) return invalidQuery(reply, "Invalid query parameters");
+
+    const result = await listOwnedLeads({
+      userId,
+      cursor: query.data.cursor,
+      limit: query.data.limit ?? DEFAULT_LIMIT,
+    });
+
+    if (!result.ok) {
+      if (result.error.kind === "invalid_cursor") {
+        return invalidQuery(reply, result.error.message);
+      }
+      // Do not surface internal error detail — log it server-side only, and
+      // with no lead field in the log line (the leads PII boundary).
+      request.log.error(
+        { route: "leads/list", error: result.error.message },
+        "leads list failed",
+      );
+      return reply.status(500).send({
+        ok: false,
+        error: { code: "internal_error", message: "Failed to read leads" },
+      });
+    }
+
+    return reply.status(200).send({ ok: true, data: result.value });
+  });
+};

package/templates/apps/api/src/routes/project-listings/__tests__/configured-application.test.ts

@@ -74,6 +74,10 @@ import {
 } from "@working-theory/validation";
 
 import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
+import {
+  mockNoWorkspace,
+  mockWorkspaceExists,
+} from "../../../lib/__mocks__/prisma.js";
 import { prisma } from "../../../lib/prisma.js";
 import { patchProjectListingDraftRoute } from "../patch-draft.js";
 import { startProjectListingRoute } from "../start.js";
@@ -181,6 +185,13 @@ function matches(row: Row, where: Record<string, unknown>): boolean {
 }
 
 function installStore(): void {
+  // #6335 — the shared prisma mock no longer resolves ANY requested
+  // workspace id. `startProjectListingDraft` stamps the row's `workspaceId`
+  // by resolving the site it was filed against (`resolveWorkspaceIdForSite`,
+  // services/project-listings.ts), so this suite states the ONE site it is
+  // built around. Keyed on the requested id — nothing else resolves.
+  mockWorkspaceExists(prisma, SITE_ID);
+
   rows = [];
   nextId = 1;
   configData = null;
@@ -239,6 +250,7 @@ function installStore(): void {
       headline: null,
       logoMarkUrl: null,
       logoWordmarkUrl: null,
+      solution: null,
       featured: false,
       decidedAt: null,
       decidedBy: null,
@@ -573,3 +585,42 @@ describe("the site's own application config (#5048 D5/D6)", () => {
     });
   });
 });
+
+// ── #6335 — the explicit workspace setup above is load-bearing ────────────
+//
+// Every case in this file states that this suite's site has a workspace.
+// This one takes that away, and proves the statement was doing work rather
+// than decorating the setup: `startProjectListingDraft` resolves the site it
+// is filing against (`resolveWorkspaceIdForSite`, services/project-listings.ts)
+// and refuses BEFORE any row is written. With the shared prisma mock's old
+// permissive default in place this case could not be written at all — every
+// id resolved, so the fail-closed path was unreachable from a route test.
+describe("#6335 — start fails closed when the site names no workspace", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installStore();
+    mockNoWorkspace(prisma);
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("answers 503 tenant_unresolved and creates no ProjectListing", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: START_PAYLOAD,
+    });
+
+    expect(res.statusCode).toBe(503);
+    expect((res.json() as { error: { code: string } }).error.code).toBe(
+      "tenant_unresolved",
+    );
+    expect(prisma.projectListing.create).not.toHaveBeenCalled();
+    expect(rows).toHaveLength(0);
+  });
+});