create-ailk 0.4.0 → 0.6.0

package/templates/apps/api/src/services/__tests__/lead-promotion.test.ts

@@ -0,0 +1,408 @@
+/**
+ * @file lead-promotion.test.ts
+ * @description Unit tests for the lead-promotion service (ADR 0009 D3
+ * service-layer pattern; spec docs/specs/3586-lead-user-promotion-spec.md §5).
+ *
+ * External dependency boundary mocked:
+ *   - apps/api/src/lib/prisma — the repo-standard `__mocks__/prisma.ts`
+ *     manual mock (`jest.mock("../../lib/prisma.js")`).
+ *
+ * `prisma.lead.findMany` is given a REALISTIC filtering implementation (over
+ * an in-memory fixture "table") rather than a static `mockResolvedValue`, so
+ * the tenant-safety test (AC-4) actually exercises what the service passes to
+ * the DB — a bug that widened the `siteId` match set would surface the
+ * cross-tenant lead here, not just in an argument-shape assertion.
+ *
+ * tenant-context.ts's `listTenancy` runs REAL — it is a pure read over the
+ * mocked `prisma.membership.findMany`, so exercising it here also covers the
+ * D3/D4 "resolve via the sole tenant-context assembler" contract rather than
+ * re-stubbing it.
+ */
+
+// eslint-disable-next-line no-restricted-syntax -- lib/prisma.ts wraps the external DB boundary (PrismaClient requires a live connection); __mocks__/prisma.ts is the repo-standard test double for this boundary.
+jest.mock("../../lib/prisma.js");
+
+import { prisma } from "../../lib/prisma.js";
+import { promoteLeadsForVerifiedUser } from "../lead-promotion";
+import type { PromoteLeadsResult } from "../lead-promotion";
+
+// ─── Fixtures ─────────────────────────────────────────────────────────────────
+
+const USER_ID = "user_00000000-0000-7000-8000-0000000000a1";
+const OWN_ORG_ID = "org_00000000-0000-7000-8000-0000000000b1";
+const OWN_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-0000000000c1";
+// OTHER_WORKSPACE_ID belongs to a different organization than OWN_ORG_ID —
+// the tenant-safety fixture AC-4 relies on (never a workspace of OWN_ORG_ID).
+const OTHER_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-0000000000c2";
+const USER_EMAIL = "verified-user@example.com";
+
+type FakeLeadRow = {
+  id: string;
+  email: string;
+  siteId: string;
+  source: string;
+  promotedUserId: string | null;
+};
+
+/** Shapes prisma.membership.findMany's mocked return — what listTenancy reads. */
+function ownMembership() {
+  return [
+    {
+      role: "owner",
+      organization: {
+        id: OWN_ORG_ID,
+        name: "Acme",
+        slug: "acme",
+        workspaces: [
+          { id: OWN_WORKSPACE_ID, name: "Acme HQ", slug: "acme-hq" },
+        ],
+      },
+    },
+  ];
+}
+
+function verifiedUser(overrides?: Partial<{ emailVerified: boolean }>) {
+  return {
+    id: USER_ID,
+    email: USER_EMAIL,
+    emailVerified: overrides?.emailVerified ?? true,
+  };
+}
+
+/**
+ * Wires prisma.lead.findMany / updateMany to a realistic in-memory "table"
+ * filtered by the (where) args the service passes — the DB-fidelity fixture
+ * AC-4 relies on: a lead outside `siteId.in` is genuinely never returned,
+ * exactly as a real WHERE clause would exclude it.
+ */
+function seedLeadTable(rows: FakeLeadRow[]) {
+  const table = rows.map((r) => ({ ...r }));
+
+  (prisma.lead.findMany as jest.Mock).mockImplementation(
+    async (args: {
+      where: {
+        email: string;
+        siteId: { in: string[] };
+        promotedUserId: null;
+      };
+      select: { id: true; siteId: true; source: true };
+    }) => {
+      const { email, siteId } = args.where;
+      return table
+        .filter(
+          (row) =>
+            row.email === email &&
+            siteId.in.includes(row.siteId) &&
+            row.promotedUserId === null,
+        )
+        .map((row) => ({ id: row.id, siteId: row.siteId, source: row.source }));
+    },
+  );
+
+  (prisma.lead.updateMany as jest.Mock).mockImplementation(
+    async (args: { where: { id: { in: string[] } }; data: { promotedUserId: string; promotedAt: Date } }) => {
+      let count = 0;
+      for (const row of table) {
+        if (args.where.id.in.includes(row.id)) {
+          row.promotedUserId = args.data.promotedUserId;
+          count += 1;
+        }
+      }
+      return { count };
+    },
+  );
+
+  return table;
+}
+
+describe("promoteLeadsForVerifiedUser", () => {
+  // This service's workspace resolution is itself module-conditional
+  // (isModuleEnabled('multi-tenant') — see lead-promotion.ts); every test
+  // below exercises that path, so it needs the module explicitly enabled
+  // now that AILK_ENABLED_MODULES unset means no paid modules (D-44, #5368).
+  const priorEnabledModules = process.env.AILK_ENABLED_MODULES;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env.AILK_ENABLED_MODULES = "multi-tenant";
+  });
+
+  afterAll(() => {
+    if (priorEnabledModules === undefined) {
+      delete process.env.AILK_ENABLED_MODULES;
+    } else {
+      process.env.AILK_ENABLED_MODULES = priorEnabledModules;
+    }
+  });
+
+  // ── AC-3: verified user + matching lead in the user's own workspace ──────
+  it("AC-3: matches an un-promoted lead in the user's own workspace and marks it promoted", async () => {
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue(verifiedUser());
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
+      ownMembership(),
+    );
+    seedLeadTable([
+      {
+        id: "lead_00000000-0000-7000-8000-0000000000d1",
+        email: USER_EMAIL,
+        siteId: OWN_WORKSPACE_ID,
+        source: "landing-page-1",
+        promotedUserId: null,
+      },
+    ]);
+
+    const result = await promoteLeadsForVerifiedUser({ userId: USER_ID });
+
+    expect(result).toEqual<PromoteLeadsResult>({
+      ok: true,
+      count: 1,
+      promoted: [
+        {
+          leadId: "lead_00000000-0000-7000-8000-0000000000d1",
+          siteId: OWN_WORKSPACE_ID,
+          source: "landing-page-1",
+        },
+      ],
+    });
+    expect(prisma.lead.findMany).toHaveBeenCalledWith({
+      where: {
+        email: USER_EMAIL,
+        siteId: { in: [OWN_WORKSPACE_ID] },
+        promotedUserId: null,
+      },
+      select: { id: true, siteId: true, source: true },
+    });
+    expect(prisma.lead.updateMany).toHaveBeenCalledWith({
+      where: { id: { in: ["lead_00000000-0000-7000-8000-0000000000d1"] } },
+      data: {
+        promotedUserId: USER_ID,
+        promotedAt: expect.any(Date),
+      },
+    });
+  });
+
+  // ── AC-4 (tenant-safety — load-bearing): cross-tenant siteId not promoted ─
+  it("AC-4: a lead whose siteId belongs to a DIFFERENT organization's workspace is not promoted", async () => {
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue(verifiedUser());
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
+      ownMembership(), // the user belongs ONLY to OWN_ORG_ID / OWN_WORKSPACE_ID
+    );
+    const table = seedLeadTable([
+      {
+        id: "lead_cross_tenant",
+        email: USER_EMAIL,
+        siteId: OTHER_WORKSPACE_ID, // a DIFFERENT organization's workspace
+        source: "contact",
+        promotedUserId: null,
+      },
+    ]);
+
+    const result = await promoteLeadsForVerifiedUser({ userId: USER_ID });
+
+    expect(result).toEqual<PromoteLeadsResult>({
+      ok: true,
+      count: 0,
+      promoted: [],
+    });
+    expect(prisma.lead.updateMany).not.toHaveBeenCalled();
+    // The cross-tenant lead's promotedUserId is untouched.
+    expect(table.find((r) => r.id === "lead_cross_tenant")?.promotedUserId).toBeNull();
+    // The query itself never widens siteId.in to the foreign workspace.
+    expect(prisma.lead.findMany).toHaveBeenCalledWith({
+      where: {
+        email: USER_EMAIL,
+        siteId: { in: [OWN_WORKSPACE_ID] },
+        promotedUserId: null,
+      },
+      select: { id: true, siteId: true, source: true },
+    });
+  });
+
+  // ── AC-5: unverified email → no-op, verified-email gate ───────────────────
+  it("AC-5: unverified email performs no lead update and returns count:0", async () => {
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue(
+      verifiedUser({ emailVerified: false }),
+    );
+
+    const result = await promoteLeadsForVerifiedUser({ userId: USER_ID });
+
+    expect(result).toEqual<PromoteLeadsResult>({
+      ok: true,
+      count: 0,
+      promoted: [],
+    });
+    expect(prisma.membership.findMany).not.toHaveBeenCalled();
+    expect(prisma.lead.findMany).not.toHaveBeenCalled();
+    expect(prisma.lead.updateMany).not.toHaveBeenCalled();
+  });
+
+  // ── AC-6: idempotent — a second invocation promotes nothing ──────────────
+  it("AC-6: a second invocation (leads already promoted) promotes nothing", async () => {
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue(verifiedUser());
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
+      ownMembership(),
+    );
+    seedLeadTable([
+      {
+        id: "lead_already_promoted",
+        email: USER_EMAIL,
+        siteId: OWN_WORKSPACE_ID,
+        source: "contact",
+        promotedUserId: USER_ID, // already promoted — excluded by the query
+      },
+    ]);
+
+    const first = await promoteLeadsForVerifiedUser({ userId: USER_ID });
+    expect(first).toEqual<PromoteLeadsResult>({
+      ok: true,
+      count: 0,
+      promoted: [],
+    });
+
+    const second = await promoteLeadsForVerifiedUser({ userId: USER_ID });
+    expect(second).toEqual<PromoteLeadsResult>({
+      ok: true,
+      count: 0,
+      promoted: [],
+    });
+    expect(prisma.lead.updateMany).not.toHaveBeenCalled();
+  });
+
+  // ── Idempotent end-to-end: promote once, re-run promotes nothing more ────
+  it("a lead promoted on the first run is excluded on the second run", async () => {
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue(verifiedUser());
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
+      ownMembership(),
+    );
+    seedLeadTable([
+      {
+        id: "lead_first_run",
+        email: USER_EMAIL,
+        siteId: OWN_WORKSPACE_ID,
+        source: "contact",
+        promotedUserId: null,
+      },
+    ]);
+
+    const first = await promoteLeadsForVerifiedUser({ userId: USER_ID });
+    expect(first).toEqual<PromoteLeadsResult>({
+      ok: true,
+      count: 1,
+      promoted: [
+        { leadId: "lead_first_run", siteId: OWN_WORKSPACE_ID, source: "contact" },
+      ],
+    });
+
+    const second = await promoteLeadsForVerifiedUser({ userId: USER_ID });
+    expect(second).toEqual<PromoteLeadsResult>({
+      ok: true,
+      count: 0,
+      promoted: [],
+    });
+  });
+
+  // ── No match → count:0 ─────────────────────────────────────────────────────
+  it("no matching lead → returns count:0 with no update", async () => {
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue(verifiedUser());
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
+      ownMembership(),
+    );
+    seedLeadTable([]);
+
+    const result = await promoteLeadsForVerifiedUser({ userId: USER_ID });
+
+    expect(result).toEqual<PromoteLeadsResult>({
+      ok: true,
+      count: 0,
+      promoted: [],
+    });
+    expect(prisma.lead.updateMany).not.toHaveBeenCalled();
+  });
+
+  // ── source preservation ────────────────────────────────────────────────────
+  it("preserves each lead's source in the result", async () => {
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue(verifiedUser());
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
+      ownMembership(),
+    );
+    seedLeadTable([
+      {
+        id: "lead_a",
+        email: USER_EMAIL,
+        siteId: OWN_WORKSPACE_ID,
+        source: "contact",
+        promotedUserId: null,
+      },
+      {
+        id: "lead_b",
+        email: USER_EMAIL,
+        siteId: OWN_WORKSPACE_ID,
+        source: "newsletter-signup",
+        promotedUserId: null,
+      },
+    ]);
+
+    const result = (await promoteLeadsForVerifiedUser({
+      userId: USER_ID,
+    })) as Extract<PromoteLeadsResult, { ok: true }>;
+
+    expect(result.ok).toBe(true);
+    expect(result.count).toBe(2);
+    expect(result.promoted).toEqual([
+      { leadId: "lead_a", siteId: OWN_WORKSPACE_ID, source: "contact" },
+      {
+        leadId: "lead_b",
+        siteId: OWN_WORKSPACE_ID,
+        source: "newsletter-signup",
+      },
+    ]);
+  });
+
+  // ── No workspaces → no-op, never queries lead ─────────────────────────────
+  it("a user with no workspaces is a no-op — never queries inbox.Lead", async () => {
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue(verifiedUser());
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue([]);
+
+    const result = await promoteLeadsForVerifiedUser({ userId: USER_ID });
+
+    expect(result).toEqual<PromoteLeadsResult>({
+      ok: true,
+      count: 0,
+      promoted: [],
+    });
+    expect(prisma.lead.findMany).not.toHaveBeenCalled();
+  });
+
+  // ── Unknown user → ok:false, user_not_found ───────────────────────────────
+  it("an unknown userId returns ok:false with kind user_not_found", async () => {
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue(null);
+
+    const result = (await promoteLeadsForVerifiedUser({
+      userId: "user_does-not-exist",
+    })) as Extract<PromoteLeadsResult, { ok: false }>;
+
+    expect(result.ok).toBe(false);
+    expect(result.error.kind).toBe("user_not_found");
+  });
+
+  // ── PII non-leak — the result never carries the user's raw email ─────────
+  it("PII non-leak — the result never carries the user's raw email field", async () => {
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue(verifiedUser());
+    (prisma.membership.findMany as jest.Mock).mockResolvedValue(
+      ownMembership(),
+    );
+    seedLeadTable([
+      {
+        id: "lead_00000000-0000-7000-8000-0000000000d1",
+        email: USER_EMAIL,
+        siteId: OWN_WORKSPACE_ID,
+        source: "contact",
+        promotedUserId: null,
+      },
+    ]);
+
+    const result = await promoteLeadsForVerifiedUser({ userId: USER_ID });
+
+    expect(JSON.stringify(result)).not.toContain(USER_EMAIL);
+  });
+});

package/templates/apps/api/src/services/__tests__/lead-routing.test.ts

@@ -392,4 +392,164 @@ describe("routeLead", () => {
     expect(result.error.kind).toBe("invalid_input");
     expect(prisma.subscriber.create).not.toHaveBeenCalled();
   });
+
+  // ── #6203/#6254 — the workspaceId stamp is ALWAYS a copy of siteId ────────
+  //
+  // routeLead(kind: "submit") has FOUR callers in this repo, and as of
+  // #6254 ALL FOUR resolve `siteId` to a real `wksp_<uuidv7>` workspace id
+  // before calling in — the three that once passed an unresolved alias
+  // (flow-engine.ts, recommender-capture.ts, project-listings.ts's
+  // submitProjectListingDraft) now resolve it themselves
+  // (`resolveSiteWorkspaceId()` / `resolveWorkspaceIdForAlias()`,
+  // `apps/api/src/lib/site.ts`). `workspaceId` is NOT NULL as of
+  // database/migrations/20260922120000_tenancy_fence, so `persistToDb` can
+  // no longer stamp `null` for an unresolved alias the way #6203 once did —
+  // it copies `siteId` unconditionally, and a caller that still somehow
+  // passed an unresolved alias hits the pre-existing
+  // `leads_workspace_id_format` CHECK loudly (via the AC-11 re-raise this
+  // file's other describe block proves) instead of landing a
+  // silently-unfenced row.
+  describe("the workspaceId stamp copies siteId unconditionally (#6203, #6254)", () => {
+    it("workspaceId is always the SAME value as siteId, whatever shape siteId carries", async () => {
+      await routeLead(leadInput, sourceMeta); // leadInput.siteId === "site-abc"
+
+      expect(prisma.lead.create).toHaveBeenCalledTimes(1);
+      const { data } = (prisma.lead.create as jest.Mock).mock.calls[0]![0];
+      expect(data.siteId).toBe("site-abc");
+      expect(data.workspaceId).toBe("site-abc");
+    });
+
+    it("a workspace-shaped siteId (the routes/leads/index.ts path) stamps workspaceId to the SAME value", async () => {
+      const resolvedInput = {
+        ...leadInput,
+        siteId: "wksp_00000000-0000-7000-8000-000000000001",
+      };
+
+      await routeLead(resolvedInput, sourceMeta);
+
+      const { data } = (prisma.lead.create as jest.Mock).mock.calls[0]![0];
+      expect(data.siteId).toBe("wksp_00000000-0000-7000-8000-000000000001");
+      expect(data.workspaceId).toBe("wksp_00000000-0000-7000-8000-000000000001");
+    });
+  });
+
+  // #6254 AC-11 (spec D6, SEC-02) — a constraint violation (the new
+  // `leads_workspace_site_agree` CHECK, or the pre-existing NOT NULL) must
+  // never be swallowed into the file fallback and a silent `ok:true`: it
+  // means OUR OWN derivation produced a row Postgres itself refuses, which
+  // is a bug to surface, not an outage to degrade through. A GENUINE
+  // infrastructure failure (the existing "DB down → file fallback" test
+  // above, a plain `Error("connection refused")` that carries none of the
+  // signals below) must still take the file fallback, unchanged.
+  describe("a constraint violation re-raises as a deliberate error, never a silent success (#6254 AC-11)", () => {
+    const listTmpDirFiles = () => fs.readdir(tmpDir);
+
+    it("a Prisma-mapped class-23 code (e.g. P2011, null constraint) returns ok:false persist_failed WITHOUT engaging the file fallback", async () => {
+      const before = await listTmpDirFiles();
+      const constraintErr = Object.assign(
+        new Error("Null constraint violation on the field: (`workspace_id`)"),
+        { code: "P2011" },
+      );
+      (prisma.lead.create as jest.Mock).mockRejectedValue(constraintErr);
+
+      const result = (await routeLead(
+        leadInput,
+        sourceMeta,
+      )) as Extract<RouteLeadResult, { ok: false }>;
+
+      expect(result.ok).toBe(false);
+      expect(result.error.kind).toBe("persist_failed");
+      // No file was written — the fallback was never attempted.
+      const after = await listTmpDirFiles();
+      expect(after).toEqual(before);
+    });
+
+    it("a raw SQLSTATE the message carries (no Prisma-mapped code — the new CHECK constraint's own shape) returns ok:false persist_failed WITHOUT engaging the file fallback", async () => {
+      const before = await listTmpDirFiles();
+      const checkErr = new Error(
+        'new row for relation "leads" violates check constraint "leads_workspace_site_agree"',
+      );
+      (prisma.lead.create as jest.Mock).mockRejectedValue(checkErr);
+
+      const result = (await routeLead(
+        leadInput,
+        sourceMeta,
+      )) as Extract<RouteLeadResult, { ok: false }>;
+
+      expect(result.ok).toBe(false);
+      expect(result.error.kind).toBe("persist_failed");
+      const after = await listTmpDirFiles();
+      expect(after).toEqual(before);
+    });
+
+    it("a bare SQLSTATE 23502 in the error message also re-raises as persist_failed", async () => {
+      const before = await listTmpDirFiles();
+      const notNullErr = Object.assign(
+        new Error("null value in column \"workspace_id\" violates not-null constraint (23502)"),
+        {},
+      );
+      (prisma.lead.create as jest.Mock).mockRejectedValue(notNullErr);
+
+      const result = (await routeLead(
+        leadInput,
+        sourceMeta,
+      )) as Extract<RouteLeadResult, { ok: false }>;
+
+      expect(result.ok).toBe(false);
+      expect(result.error.kind).toBe("persist_failed");
+      const after = await listTmpDirFiles();
+      expect(after).toEqual(before);
+    });
+
+    it("a genuine outage (no class-23 signal) still takes the file fallback — persisted:file, not persist_failed", async () => {
+      // Regression guard for the branch above: an ordinary connection error
+      // must not be misclassified as a constraint violation.
+      (prisma.lead.create as jest.Mock).mockRejectedValue(
+        new Error("connection refused"),
+      );
+
+      const result = (await routeLead(
+        leadInput,
+        sourceMeta,
+      )) as Extract<RouteLeadResult, { ok: true }>;
+
+      expect(result.ok).toBe(true);
+      expect(result.persisted).toBe("file");
+    });
+  });
+});
+
+// ─── #6257 — the fence: every fenced read carries workspaceId ───────────────
+
+/**
+ * Unit C2's contract for this service (#6257 AC-1/AC-2). `routeLead`'s one
+ * READ is the duplicate-subscriber lookup on the P2002 arm. `input.siteId` is
+ * the resolved workspace id at every caller (the same guarantee the three
+ * `create` sites above stamp on), so the lookup is scoped by it rather than
+ * resolving a second time.
+ */
+describe("#6257 — the duplicate-subscriber lookup carries workspaceId", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env.DATABASE_URL = "postgres://test";
+  });
+
+  it("scopes the existing-subscriber read by the caller's resolved workspace id", async () => {
+    (prisma.subscriber.create as jest.Mock).mockRejectedValue(
+      Object.assign(new Error("Unique constraint failed"), { code: "P2002" }),
+    );
+    (prisma.subscriber.findUnique as jest.Mock).mockResolvedValue({ id: "sub_1" });
+
+    await routeLead(
+      { ...subscribeInput, email: "dupe@example.com" },
+      sourceMeta,
+    );
+
+    const { where } = (prisma.subscriber.findUnique as jest.Mock).mock.calls[0][0];
+    expect(where.workspaceId).toBe(subscribeInput.siteId);
+    expect(where.siteId_email).toEqual({
+      siteId: subscribeInput.siteId,
+      email: "dupe@example.com",
+    });
+  });
 });