create-ailk 0.4.0 → 0.6.0

package/templates/apps/api/src/routes/project-listings/__tests__/site-answers.test.ts

@@ -57,6 +57,10 @@ import type { FastifyInstance } from "fastify";
 import { SITE_LISTING_CONFIG_DEFAULTS } from "@working-theory/validation";
 
 import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
+import {
+  mockNoWorkspace,
+  mockWorkspaceExists,
+} from "../../../lib/__mocks__/prisma.js";
 import { prisma } from "../../../lib/prisma.js";
 import { listProjectListings } from "../../../services/project-listings.js";
 import { patchProjectListingDraftRoute } from "../patch-draft.js";
@@ -137,6 +141,8 @@ const COLLECTED_WITH_OPT_IN = [
   "logoMarkUrl",
   "logoWordmarkUrl",
   "requestedWindowDays",
+  // #5096 — the fourth. Same opt-in treatment for the same reason.
+  "solution",
 ];
 
 const COLLECTED_BEFORE_5285 = [
@@ -198,6 +204,13 @@ function matches(row: Row, where: Record<string, unknown>): boolean {
 }
 
 function installStore(): void {
+  // #6335 — the shared prisma mock no longer resolves ANY requested
+  // workspace id. `startProjectListingDraft` stamps the row's `workspaceId`
+  // by resolving the site it was filed against (`resolveWorkspaceIdForSite`,
+  // services/project-listings.ts), so this suite states the ONE site it is
+  // built around. Keyed on the requested id — nothing else resolves.
+  mockWorkspaceExists(prisma, SITE_ID);
+
   rows = [];
   nextId = 1;
   configData = null;
@@ -258,6 +271,7 @@ function installStore(): void {
       headline: null,
       logoMarkUrl: null,
       logoWordmarkUrl: null,
+      solution: null,
       featured: false,
       decidedAt: null,
       decidedBy: null,
@@ -552,9 +566,9 @@ describe("the site-answers store's anonymous-write bounds (#5285)", () => {
     });
   });
 
-  // ── The three contract fields ──
+  // ── The four contract fields ──
 
-  describe("the three contract fields that became writable", () => {
+  describe("the four contract fields that became writable", () => {
     it("patch: the two logo urls round-trip onto the row, on a site that asked", async () => {
       configData = { collectedFields: COLLECTED_WITH_OPT_IN };
       const draft = await startDraft(app);
@@ -569,7 +583,7 @@ describe("the site-answers store's anonymous-write bounds (#5285)", () => {
       expect(rows[0]!["logoWordmarkUrl"]).toBe("https://cdn.example.com/wordmark.svg");
     });
 
-    it("patch: REFUSES all three on a site that never opted in, writing nothing", async () => {
+    it("patch: REFUSES all four on a site that never opted in, writing nothing", async () => {
       // The defect the back-compat review found, at the route. `collectedFields`
       // defaults to every field the payload defines, so adding these three
       // silently made them writable on every site that had configured nothing —
@@ -583,12 +597,14 @@ describe("the site-answers store's anonymous-write bounds (#5285)", () => {
         { logoMarkUrl: "https://evil.example/a.png" },
         { logoWordmarkUrl: "https://evil.example/b.svg" },
         { requestedWindowDays: 9000 },
+        { solution: "Text a site never asked for." },
       ]) {
         expect((await patch(app, draft, body)).statusCode).toBe(400);
       }
 
       expect(rows[0]!["logoMarkUrl"]).toBeNull();
       expect(rows[0]!["logoWordmarkUrl"]).toBeNull();
+      expect(rows[0]!["solution"]).toBeNull();
     });
 
     it("patch: refuses a logo url that is not http(s) — they render as image sources", async () => {
@@ -650,15 +666,20 @@ describe("the site-answers store's anonymous-write bounds (#5285)", () => {
 
   // ── The floor the three new fields must not move ──
 
-  describe("submit requirements are unchanged by the three added fields", () => {
-    it("the three are OPT-IN, absent from the default collected set, and never required at submit", async () => {
+  describe("submit requirements are unchanged by the four added fields", () => {
+    it("the four are OPT-IN, absent from the default collected set, and never required at submit", async () => {
       // This assertion was inverted by the back-compat review. The default
       // `collectedFields` derives from the application schema's own shape, so
       // adding a field WIDENED what an anonymous caller could write on every
       // site that never wrote an explicit mask — and the two logo fields ride
       // the public read and render as image sources. They are excluded from
       // the default now; a site that wants them names them.
-      for (const field of ["logoMarkUrl", "logoWordmarkUrl", "requestedWindowDays"]) {
+      for (const field of [
+        "logoMarkUrl",
+        "logoWordmarkUrl",
+        "requestedWindowDays",
+        "solution",
+      ]) {
         expect(SITE_LISTING_CONFIG_DEFAULTS.collectedFields).not.toContain(field);
       }
 
@@ -672,6 +693,7 @@ describe("the site-answers store's anonymous-write bounds (#5285)", () => {
       expect(rows[0]!["status"]).toBe("requested");
       expect(rows[0]!["logoMarkUrl"]).toBeNull();
       expect(rows[0]!["logoWordmarkUrl"]).toBeNull();
+      expect(rows[0]!["solution"]).toBeNull();
     });
 
     it("a site whose stored collectedFields predates #5285 submits exactly as it did", async () => {
@@ -712,6 +734,85 @@ describe("the site-answers store's anonymous-write bounds (#5285)", () => {
       expect(body.error.missingFields).not.toContain("logoMarkUrl");
       expect(body.error.missingFields).not.toContain("logoWordmarkUrl");
       expect(body.error.missingFields).not.toContain("requestedWindowDays");
+      expect(body.error.missingFields).not.toContain("solution");
+    });
+  });
+
+  // ── #5096 — `solution` round-trips for a site that asked ──
+
+  describe("the `solution` field (#5096)", () => {
+    it("patch: persists it onto the row, on a site that asked", async () => {
+      configData = { collectedFields: COLLECTED_WITH_OPT_IN };
+      const draft = await startDraft(app);
+
+      const res = await patch(app, draft, { solution: "We publish the answer, not the page." });
+
+      expect(res.statusCode).toBe(200);
+      expect(rows[0]!["solution"]).toBe("We publish the answer, not the page.");
     });
+
+    it("patch: refuses an empty solution and one over 600 chars", async () => {
+      configData = { collectedFields: COLLECTED_WITH_OPT_IN };
+      const draft = await startDraft(app);
+
+      expect((await patch(app, draft, { solution: "" })).statusCode).toBe(400);
+      expect((await patch(app, draft, { solution: "x".repeat(601) })).statusCode).toBe(400);
+      expect(rows[0]!["solution"]).toBeNull();
+    });
+
+    // The half that would fail QUIETLY: `submit` validates an application
+    // reassembled from the ROW, and a stored value the reassembly drops is
+    // indistinguishable — from the founder's side — from one that saved.
+    it("submit: the stored solution survives the row-reassembly `submit` validates", async () => {
+      configData = { collectedFields: COLLECTED_WITH_OPT_IN };
+      const draft = await startDraft(app);
+      await patch(app, draft, COMPLETE_APPLICATION);
+      await patch(app, draft, { solution: "We publish the answer, not the page." });
+
+      const res = await submit(app, draft);
+
+      expect(res.statusCode).toBe(200);
+      expect(rows[0]!["status"]).toBe("requested");
+      expect(rows[0]!["solution"]).toBe("We publish the answer, not the page.");
+    });
+  });
+});
+
+// ── #6335 — the explicit workspace setup above is load-bearing ────────────
+//
+// Every case in this file states that this suite's site has a workspace.
+// This one takes that away, and proves the statement was doing work rather
+// than decorating the setup: `startProjectListingDraft` resolves the site it
+// is filing against (`resolveWorkspaceIdForSite`, services/project-listings.ts)
+// and refuses BEFORE any row is written. With the shared prisma mock's old
+// permissive default in place this case could not be written at all — every
+// id resolved, so the fail-closed path was unreachable from a route test.
+describe("#6335 — start fails closed when the site names no workspace", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installStore();
+    mockNoWorkspace(prisma);
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("answers 503 tenant_unresolved and creates no ProjectListing", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: START_PAYLOAD,
+    });
+
+    expect(res.statusCode).toBe(503);
+    expect((res.json() as { error: { code: string } }).error.code).toBe(
+      "tenant_unresolved",
+    );
+    expect(prisma.projectListing.create).not.toHaveBeenCalled();
+    expect(rows).toHaveLength(0);
   });
 });

package/templates/apps/api/src/routes/project-listings/__tests__/site-key.test.ts

@@ -50,10 +50,17 @@ jest.mock("@working-theory/license", () => ({
   }),
 }));
 
+import { DEFAULT_WORKSPACE_ID } from "@working-theory/database/tenancy";
 import Fastify from "fastify";
 import type { FastifyInstance } from "fastify";
 
+import {
+  mockNoWorkspace,
+  mockSentinelWorkspaceExists,
+  mockWorkspaceExists,
+} from "../../../lib/__mocks__/prisma.js";
 import { prisma } from "../../../lib/prisma.js";
+import { __resetSiteWorkspaceCacheForTests } from "../../../lib/site.js";
 import { publicProjectListingsRoute } from "../public.js";
 import { startProjectListingRoute } from "../start.js";
 
@@ -106,6 +113,14 @@ function installStore(): void {
   rows = [];
   nextId = 1;
 
+  // #6335 — the shared prisma mock no longer resolves ANY requested
+  // workspace id, so this suite states the two sites it is built around.
+  // `resolveWorkspaceIdForSite` (services/project-listings.ts) keys on the
+  // requested id, and nothing else resolves: the env-alias cases below add
+  // the ONE further id each of them expects, and the stamp suite's refusal
+  // case takes them all away.
+  mockWorkspaceExists(prisma, SITE_A, SITE_B);
+
   // One delegate, two lookups (#5048 D2): `where.publicKey` is the site-key
   // resolution, `where.siteId` the per-site config read. No config row for the
   // latter, so the platform defaults apply.
@@ -158,6 +173,7 @@ function installStore(): void {
       headline: null,
       logoMarkUrl: null,
       logoWordmarkUrl: null,
+      solution: null,
       featured: false,
       decidedAt: null,
       decidedBy: null,
@@ -214,6 +230,7 @@ function seedActiveListing(siteId: string, slug: string): void {
     questions: null,
     logoMarkUrl: null,
     logoWordmarkUrl: null,
+    solution: null,
     featured: false,
     status: "active",
     consentAt: new Date("2026-08-01T00:00:00.000Z"),
@@ -254,6 +271,12 @@ describe("the public site key (#5048 D2)", () => {
     savedPublicKey = process.env["AILK_LISTING_PUBLIC_KEY"];
     delete process.env["AILK_SITE_ID"];
     delete process.env["AILK_LISTING_PUBLIC_KEY"];
+    // #6254 — `resolveSiteWorkspaceId()` memoizes its FIRST successful
+    // resolution for the process lifetime (by design, for the hot request
+    // path); several tests in this file change `AILK_SITE_ID` between runs,
+    // so the memo must be cleared per test or a later test would silently
+    // reuse an earlier test's resolved workspace id.
+    __resetSiteWorkspaceCacheForTests();
     app = await buildApp();
   });
 
@@ -331,22 +354,34 @@ describe("the public site key (#5048 D2)", () => {
     expect(rows.some((r) => r["siteId"] === "the-deployments-own-site")).toBe(false);
   });
 
-  it("start (single-tenant): AILK_LISTING_PUBLIC_KEY resolves to currentSiteId() with no config row", async () => {
+  it("start (single-tenant): AILK_LISTING_PUBLIC_KEY resolves to the RESOLVED currentSiteId() workspace, with no config row", async () => {
     // The default `create-ailk` scaffold is one customer per deployment and
     // has no `SiteListingConfig` row at all; requiring one would mean a site
     // could not accept an application until an operator wrote a database row.
+    //
+    // #6254 AC-6/AC-10 — `siteIdForPublicKey`'s single-tenant fallback now
+    // resolves the alias (`resolveSiteWorkspaceId()`) rather than returning
+    // the raw `"default"` literal: `project_listings` rejects a `site_id`
+    // that disagrees with `workspace_id`
+    // (database/migrations/20260922120000_tenancy_fence), and the two must
+    // agree from create time.
     process.env["AILK_LISTING_PUBLIC_KEY"] = "pk-single-tenant";
     delete process.env["AILK_SITE_ID"]; // → currentSiteId() falls back to "default"
+    // #6335 — the "default" alias resolves through the SENTINEL workspace
+    // row, which this case (alone in the file) expects to exist.
+    mockSentinelWorkspaceExists(prisma, SITE_A, SITE_B);
 
     const res = await start(app, { ...START_PAYLOAD, siteKey: "pk-single-tenant" });
 
     expect(res.statusCode).toBe(201);
-    expect(rows[0]!["siteId"]).toBe("default");
+    expect(rows[0]!["siteId"]).toBe(DEFAULT_WORKSPACE_ID);
   });
 
   it("start (single-tenant): the env key resolves to AILK_SITE_ID where one is set", async () => {
     process.env["AILK_LISTING_PUBLIC_KEY"] = "pk-single-tenant";
     process.env["AILK_SITE_ID"] = "the-only-site";
+    // #6335 — this case's own deployment site, named explicitly.
+    mockWorkspaceExists(prisma, SITE_A, SITE_B, "the-only-site");
 
     const res = await start(app, { ...START_PAYLOAD, siteKey: "pk-single-tenant" });
 
@@ -397,3 +432,53 @@ describe("the public site key (#5048 D2)", () => {
     expect(prisma.projectListing.findMany).not.toHaveBeenCalled();
   });
 });
+
+// ── #6203 AC-4 — the workspace stamp, and its own refusal ──────────────────
+//
+// The site-key resolution above (siteKey -> siteId) is UNCHANGED by #6203 —
+// it was already server-side and already refused a body-supplied override,
+// which the suite above already proves. What #6203 adds is a SECOND, NEW
+// resolution on top of that already-resolved siteId: siteId -> workspaceId
+// (`project-listings.ts`'s `resolveWorkspaceIdForSite`). There is no THIRD
+// body field for an attacker to spoof here (`projectListingStartSchema`
+// carries no workspaceId-shaped field at all, and the suite above already
+// proves a body-supplied `siteId` is refused outright) — so the only new
+// behaviour to assert is this second resolution's own failure mode.
+describe("the workspace stamp (#6203) — start's second resolution, on top of siteKey", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installStore();
+    delete process.env["AILK_SITE_ID"];
+    delete process.env["AILK_LISTING_PUBLIC_KEY"];
+    __resetSiteWorkspaceCacheForTests();
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("a siteId that resolves via siteKey but names no workspace is a 503 tenant_unresolved, and writes no row", async () => {
+    mockNoWorkspace(prisma);
+
+    const res = await start(app, { ...START_PAYLOAD, siteKey: KEY_A });
+
+    expect(res.statusCode).toBe(503);
+    expect((res.json() as { error: { code: string } }).error.code).toBe(
+      "tenant_unresolved",
+    );
+    expect(prisma.projectListing.create).not.toHaveBeenCalled();
+    expect(rows).toHaveLength(0);
+  });
+
+  it("on resolution, the created row carries workspaceId equal to the resolved siteId", async () => {
+    const res = await start(app, { ...START_PAYLOAD, siteKey: KEY_B });
+
+    expect(res.statusCode).toBe(201);
+    expect(rows).toHaveLength(1);
+    expect(rows[0]!["siteId"]).toBe(SITE_B);
+    expect(rows[0]!["workspaceId"]).toBe(SITE_B);
+  });
+});

package/templates/apps/api/src/routes/project-listings/__tests__/structured-address.test.ts

@@ -62,6 +62,10 @@ import Fastify from "fastify";
 import type { FastifyInstance } from "fastify";
 
 import { setupLeadFileEnv } from "../../../__tests__/factories/lead-fixture";
+import {
+  mockNoWorkspace,
+  mockWorkspaceExists,
+} from "../../../lib/__mocks__/prisma.js";
 import { prisma } from "../../../lib/prisma.js";
 import { patchProjectListingDraftRoute } from "../patch-draft.js";
 import { startProjectListingRoute } from "../start.js";
@@ -178,6 +182,13 @@ function matches(row: Row, where: Record<string, unknown>): boolean {
 }
 
 function installStore(): void {
+  // #6335 — the shared prisma mock no longer resolves ANY requested
+  // workspace id. `startProjectListingDraft` stamps the row's `workspaceId`
+  // by resolving the site it was filed against (`resolveWorkspaceIdForSite`,
+  // services/project-listings.ts), so this suite states the ONE site it is
+  // built around. Keyed on the requested id — nothing else resolves.
+  mockWorkspaceExists(prisma, SITE_ID);
+
   rows = [];
   nextId = 1;
 
@@ -243,6 +254,7 @@ function installStore(): void {
       headline: null,
       logoMarkUrl: null,
       logoWordmarkUrl: null,
+      solution: null,
       featured: false,
       decidedAt: null,
       decidedBy: null,
@@ -482,3 +494,42 @@ describe("the structured founder address (#5279)", () => {
     });
   });
 });
+
+// ── #6335 — the explicit workspace setup above is load-bearing ────────────
+//
+// Every case in this file states that this suite's site has a workspace.
+// This one takes that away, and proves the statement was doing work rather
+// than decorating the setup: `startProjectListingDraft` resolves the site it
+// is filing against (`resolveWorkspaceIdForSite`, services/project-listings.ts)
+// and refuses BEFORE any row is written. With the shared prisma mock's old
+// permissive default in place this case could not be written at all — every
+// id resolved, so the fail-closed path was unreachable from a route test.
+describe("#6335 — start fails closed when the site names no workspace", () => {
+  let app: FastifyInstance;
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    installStore();
+    mockNoWorkspace(prisma);
+    app = await buildApp();
+  });
+
+  afterEach(async () => {
+    await app.close();
+  });
+
+  it("answers 503 tenant_unresolved and creates no ProjectListing", async () => {
+    const res = await app.inject({
+      method: "POST",
+      url: "/v1/project-listings",
+      payload: START_PAYLOAD,
+    });
+
+    expect(res.statusCode).toBe(503);
+    expect((res.json() as { error: { code: string } }).error.code).toBe(
+      "tenant_unresolved",
+    );
+    expect(prisma.projectListing.create).not.toHaveBeenCalled();
+    expect(rows).toHaveLength(0);
+  });
+});

package/templates/apps/api/src/routes/project-listings/start.ts

@@ -110,7 +110,11 @@ export const startProjectListingRoute: FastifyPluginAsync = async (fastify) => {
     // #5275 — a `consents` map declining a REQUIRED purpose contradicts the
     // body's own `consent: true`; no row was created.
     if (!result.ok) {
-      return reply.status(400).send({
+      // #6203 — `tenant_unresolved` is a server-side tenancy
+      // misconfiguration (the resolved `siteId` names no workspace this
+      // database holds), not a client input problem — 503, never 400.
+      const status = result.error.kind === "tenant_unresolved" ? 503 : 400;
+      return reply.status(status).send({
         ok: false,
         error: { code: result.error.kind, message: result.error.message },
       });