create-ailk 0.4.0 → 0.6.0

package/templates/apps/mcp/__tests__/start_purchase.test.ts

@@ -0,0 +1,252 @@
+/**
+ * `start_purchase` — the MCP half of the API↔MCP parity proof (#5971 D7),
+ * plus FR-1 and FR-2, rewritten for #6001's redirect fix.
+ *
+ * `apps/api` cannot import `apps/mcp` and vice versa, so neither side can
+ * call the other in a test. The evidence is the SHARED SEAM asserted from
+ * both ends — `CreateSessionPayload` / `CheckoutSessionResponse` in
+ * `packages/api-client/src/checkout.ts`:
+ *
+ *   here          — the tool calls `checkout.createSession` with EXACTLY the
+ *                   payload object the route validates, and its return value
+ *                   deep-equals `{ url }` from the seam;
+ *   the API end    — `apps/api/src/routes/checkout/__tests__/sessions.test.ts`
+ *                   § "parity with the payload the MCP tool builds (#5971)"
+ *                   feeds that same payload to the route and pins its reply.
+ *
+ * Idiom: `apps/mcp/__tests__/search_content.test.ts`, the worked example root
+ * `CLAUDE.md` § API ↔ MCP parity names.
+ *
+ * #6001: three security reviews on PR #5991 (two High, one Medium) found
+ * that an anonymous MCP caller could forward its own successUrl/cancelUrl to
+ * `checkout.createSession` — the payment succeeds so no fraud signal fires,
+ * making it a phishing-amplification open redirect off the seller's real
+ * checkout — and that `allowPromotionCodes` had no reason to be
+ * caller-controlled on an anonymous surface either. The tool now validates
+ * against `purchaseMcpInputSchema` (a strict productCode+quantity-only pick
+ * of the shared schema), so it can never build a payload containing a
+ * caller-supplied redirect: both `successUrl` and `cancelUrl` are ALWAYS
+ * derived from `AILK_BASE_URL`, and `allowPromotionCodes` is never forwarded.
+ *
+ * Nothing here reaches Stripe or a licence server (NFR-6).
+ */
+
+import { checkout } from "@working-theory/api-client";
+
+import {
+  __setMcpCommerceClaimForTest,
+  resetMcpCommerceClaim,
+} from "../src/lib/commerce-claim.js";
+import { ailkPurchase } from "../src/tools/purchase.js";
+
+jest.mock("@working-theory/api-client", () => ({
+  checkout: { createSession: jest.fn() },
+}));
+
+const createSession = checkout.createSession as jest.MockedFunction<
+  typeof checkout.createSession
+>;
+
+const HOSTED_URL = "https://checkout.stripe.com/c/pay/cs_test_abc123";
+
+function sessionCreated() {
+  return {
+    ok: true as const,
+    body: { sessionId: "cs_test_abc123", url: HOSTED_URL },
+  };
+}
+
+beforeEach(() => {
+  __setMcpCommerceClaimForTest("claimed");
+  process.env.AILK_BASE_URL = "https://example.com";
+});
+
+afterEach(() => {
+  jest.clearAllMocks();
+  resetMcpCommerceClaim();
+  delete process.env.AILK_BASE_URL;
+});
+
+describe("start_purchase — parity with the payload POST /v1/checkout/sessions takes (#5971, #6001)", () => {
+  it("calls checkout.createSession with EXACTLY the route's payload shape, redirects derived — never caller-supplied", async () => {
+    createSession.mockResolvedValueOnce(sessionCreated());
+
+    await ailkPurchase({
+      productCode: "pro-plan",
+      quantity: 2,
+    });
+
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(createSession).toHaveBeenCalledWith({
+      productCode: "pro-plan",
+      quantity: 2,
+      successUrl:
+        "https://example.com/purchase/success?session_id={CHECKOUT_SESSION_ID}",
+      cancelUrl: "https://example.com/purchase/cancel",
+    });
+  });
+
+  it("omits quantity entirely when it is not supplied", async () => {
+    createSession.mockResolvedValueOnce(sessionCreated());
+
+    await ailkPurchase({ productCode: "pro-plan" });
+
+    const payload = createSession.mock.calls[0]![0];
+    expect(payload).not.toHaveProperty("quantity");
+    expect(payload).not.toHaveProperty("allowPromotionCodes");
+  });
+
+  it("derives both redirect URLs from AILK_BASE_URL — always, not only when omitted (#6001)", async () => {
+    createSession.mockResolvedValueOnce(sessionCreated());
+
+    await ailkPurchase({ productCode: "pro-plan" });
+
+    expect(createSession).toHaveBeenCalledWith({
+      productCode: "pro-plan",
+      successUrl:
+        "https://example.com/purchase/success?session_id={CHECKOUT_SESSION_ID}",
+      cancelUrl: "https://example.com/purchase/cancel",
+    });
+  });
+});
+
+describe("start_purchase — FR-1: the hosted Checkout URL", () => {
+  it("returns { url } deep-equal to the seam's url, and nothing else", async () => {
+    createSession.mockResolvedValueOnce(sessionCreated());
+
+    const result = await ailkPurchase({ productCode: "pro-plan" });
+
+    expect(result).toEqual({ url: HOSTED_URL });
+  });
+
+  it("does NOT surface the route's sessionId (D5 — it identifies a buyer's session)", async () => {
+    createSession.mockResolvedValueOnce(sessionCreated());
+
+    const result = await ailkPurchase({ productCode: "pro-plan" });
+
+    expect(result).not.toHaveProperty("sessionId");
+  });
+
+  it("the URL it returns is Stripe-hosted — nothing is charged in-tool", async () => {
+    createSession.mockResolvedValueOnce(sessionCreated());
+
+    const result = await ailkPurchase({ productCode: "pro-plan" });
+
+    expect((result as { url: string }).url).toMatch(
+      /^https:\/\/checkout\.stripe\.com\//,
+    );
+  });
+});
+
+describe("start_purchase — FR-2: an unknown offering", () => {
+  it("does NOT echo the caller's product code back (route invariant parity)", async () => {
+    createSession.mockResolvedValueOnce({
+      ok: false as const,
+      status: 404,
+      body: { error: "unknown-product-code" },
+    });
+
+    const result = await ailkPurchase({ productCode: "no-such-offering" });
+
+    // The HTTP twin states and tests "Error responses never echo user input";
+    // parity means the pair answers alike (#5971 security review, Low).
+    expect(JSON.stringify(result)).not.toContain("no-such-offering");
+  });
+
+  it("returns a typed not_found body rather than throwing", async () => {
+    createSession.mockResolvedValueOnce({
+      ok: false as const,
+      status: 404,
+      body: { error: "unknown-product-code" },
+    });
+
+    const result = await ailkPurchase({ productCode: "no-such-offering" });
+
+    expect(result).toMatchObject({ error: "not_found" });
+  });
+
+  it("makes exactly one call — createSession — and reaches no Stripe stub", async () => {
+    createSession.mockResolvedValueOnce({
+      ok: false as const,
+      status: 404,
+      body: { error: "unknown-product-code" },
+    });
+
+    await ailkPurchase({ productCode: "no-such-offering" });
+
+    expect(createSession).toHaveBeenCalledTimes(1);
+  });
+
+  it("maps a non-404 route failure to a typed body too", async () => {
+    createSession.mockResolvedValueOnce({
+      ok: false as const,
+      status: 502,
+      body: { error: "checkout-unavailable" },
+    });
+
+    const result = await ailkPurchase({ productCode: "pro-plan" });
+
+    expect(result).toMatchObject({ error: "validation_failed" });
+  });
+});
+
+describe("start_purchase — invalid input never reaches the seam", () => {
+  it("rejects a product code the route's regex would reject", async () => {
+    const result = await ailkPurchase({ productCode: "has spaces" });
+
+    expect(result).toMatchObject({ error: "validation_failed" });
+    expect(createSession).not.toHaveBeenCalled();
+  });
+
+  it("rejects a quantity above the route's maximum", async () => {
+    const result = await ailkPurchase({
+      productCode: "pro-plan",
+      quantity: 1000,
+    });
+
+    expect(result).toMatchObject({ error: "validation_failed" });
+    expect(createSession).not.toHaveBeenCalled();
+  });
+});
+
+describe("start_purchase — the redirect fix (#6001): a caller-supplied redirect fails validation, not merely gets ignored", () => {
+  it("rejects a call carrying a caller-supplied successUrl — even a plausible-looking one, not just javascript:", async () => {
+    const result = await ailkPurchase({
+      productCode: "pro-plan",
+      successUrl: "https://attacker.example/phish",
+    } as never);
+
+    expect(result).toMatchObject({ error: "validation_failed" });
+    expect(createSession).not.toHaveBeenCalled();
+  });
+
+  it("rejects a javascript: redirect URL exactly as the route would — via the same rejection path as any other successUrl", async () => {
+    const result = await ailkPurchase({
+      productCode: "pro-plan",
+      successUrl: "javascript:alert(1)",
+    } as never);
+
+    expect(result).toMatchObject({ error: "validation_failed" });
+    expect(createSession).not.toHaveBeenCalled();
+  });
+
+  it("rejects a call carrying a caller-supplied cancelUrl", async () => {
+    const result = await ailkPurchase({
+      productCode: "pro-plan",
+      cancelUrl: "https://attacker.example/cancelled",
+    } as never);
+
+    expect(result).toMatchObject({ error: "validation_failed" });
+    expect(createSession).not.toHaveBeenCalled();
+  });
+
+  it("rejects a call carrying allowPromotionCodes", async () => {
+    const result = await ailkPurchase({
+      productCode: "pro-plan",
+      allowPromotionCodes: true,
+    } as never);
+
+    expect(result).toMatchObject({ error: "validation_failed" });
+    expect(createSession).not.toHaveBeenCalled();
+  });
+});

package/templates/apps/mcp/__tests__/tools/{scaffold.test.ts → create_project.test.ts}

@@ -1,16 +1,16 @@
 /**
- * Tests for the ailkScaffold MCP tool handler.
+ * Tests for the ailkCreateProject MCP tool handler.
  *
  * Acceptance criteria verified here:
  * - scaffoldInputSchema validates correct inputs
  * - scaffoldInputSchema rejects invalid inputs (empty projectName, missing targetDir)
- * - ailkScaffold scaffolds into a tmp dir: package.json + ≥1 file created
- * - ailkScaffold fails cleanly when targetDir is non-empty (rejects with Error)
+ * - ailkCreateProject scaffolds into a tmp dir: package.json + ≥1 file created
+ * - ailkCreateProject fails cleanly when targetDir is non-empty (rejects with Error)
  * - Output validates against scaffoldOutputSchema
  * - No direct create-ailk import in apps/mcp (architectural guard)
  *
  * Hermetic: uses os.tmpdir() + unique subdir. No network calls.
- * Integration tests pass CLI_PATH explicitly to ailkScaffold (second arg)
+ * Integration tests pass CLI_PATH explicitly to ailkCreateProject (second arg)
  * so they don't depend on process.cwd() being the repo root in Jest.
  */
 
@@ -26,7 +26,7 @@ import { join, resolve } from "node:path";
 
 import { scaffoldInputSchema, scaffoldOutputSchema } from "@working-theory/validation";
 
-import { ailkScaffold } from "../../src/tools/scaffold.js";
+import { ailkCreateProject } from "../../src/tools/create_project.js";
 
 // ── Input schema tests ────────────────────────────────────────────────────────
 
@@ -103,13 +103,13 @@ describe("scaffoldOutputSchema", () => {
 const REPO_ROOT = resolve(__dirname, "../../../..");
 const CLI_PATH = join(REPO_ROOT, "packages/create-ailk/dist/cli.js");
 
-describe("ailkScaffold handler", () => {
+describe("ailkCreateProject handler", () => {
   let scratch: string;
 
   beforeAll(() => {
     if (!existsSync(CLI_PATH)) {
       console.warn(
-        `[scaffold.test] create-ailk CLI not built: ${CLI_PATH} missing. ` +
+        `[create_project.test] create-ailk CLI not built: ${CLI_PATH} missing. ` +
           "Run `pnpm --filter create-ailk build` first.",
       );
     }
@@ -125,11 +125,11 @@ describe("ailkScaffold handler", () => {
 
   it("scaffolds at least one file into a fresh tmp dir and reports targetDir", async () => {
     if (!existsSync(CLI_PATH)) {
-      console.warn("[scaffold.test] skipping integration test — CLI not built");
+      console.warn("[create_project.test] skipping integration test — CLI not built");
       return;
     }
     const target = join(scratch, "my-site");
-    const output = await ailkScaffold(
+    const output = await ailkCreateProject(
       { targetDir: target, projectName: "my-site" },
       CLI_PATH,
     );
@@ -139,37 +139,37 @@ describe("ailkScaffold handler", () => {
 
   it("scaffolds package.json when full templates are built (build-templates required)", async () => {
     if (!existsSync(CLI_PATH)) {
-      console.warn("[scaffold.test] skipping integration test — CLI not built");
+      console.warn("[create_project.test] skipping integration test — CLI not built");
       return;
     }
     const TEMPLATES_DIR = join(REPO_ROOT, "packages/create-ailk/templates");
     const PKG_JSON_IN_TEMPLATES = join(TEMPLATES_DIR, "package.json");
     if (!existsSync(PKG_JSON_IN_TEMPLATES)) {
       console.warn(
-        "[scaffold.test] skipping package.json assertion — run `pnpm --filter create-ailk run build-templates` first",
+        "[create_project.test] skipping package.json assertion — run `pnpm --filter create-ailk run build-templates` first",
       );
       return;
     }
     const target = join(scratch, "my-site");
-    await ailkScaffold({ targetDir: target, projectName: "my-site" }, CLI_PATH);
+    await ailkCreateProject({ targetDir: target, projectName: "my-site" }, CLI_PATH);
     expect(existsSync(join(target, "package.json"))).toBe(true);
   });
 
   it("scaffolds app dir when full templates are built (build-templates required)", async () => {
     if (!existsSync(CLI_PATH)) {
-      console.warn("[scaffold.test] skipping integration test — CLI not built");
+      console.warn("[create_project.test] skipping integration test — CLI not built");
       return;
     }
     const TEMPLATES_DIR = join(REPO_ROOT, "packages/create-ailk/templates");
     const PKG_JSON_IN_TEMPLATES = join(TEMPLATES_DIR, "package.json");
     if (!existsSync(PKG_JSON_IN_TEMPLATES)) {
       console.warn(
-        "[scaffold.test] skipping app dir assertion — run `pnpm --filter create-ailk run build-templates` first",
+        "[create_project.test] skipping app dir assertion — run `pnpm --filter create-ailk run build-templates` first",
       );
       return;
     }
     const target = join(scratch, "my-site");
-    await ailkScaffold({ targetDir: target, projectName: "my-site" }, CLI_PATH);
+    await ailkCreateProject({ targetDir: target, projectName: "my-site" }, CLI_PATH);
     // The template produces apps/web/app/ from the monorepo template snapshot.
     const hasApp =
       existsSync(join(target, "app")) ||
@@ -179,22 +179,22 @@ describe("ailkScaffold handler", () => {
 
   it("returns at least one file (schema-typed page seed or README.md)", async () => {
     if (!existsSync(CLI_PATH)) {
-      console.warn("[scaffold.test] skipping integration test — CLI not built");
+      console.warn("[create_project.test] skipping integration test — CLI not built");
       return;
     }
     const target = join(scratch, "my-site");
-    await ailkScaffold({ targetDir: target, projectName: "my-site" }, CLI_PATH);
+    await ailkCreateProject({ targetDir: target, projectName: "my-site" }, CLI_PATH);
     // At minimum README.md is always emitted by the template.
     expect(existsSync(join(target, "README.md"))).toBe(true);
   });
 
   it("returns output conforming to scaffoldOutputSchema", async () => {
     if (!existsSync(CLI_PATH)) {
-      console.warn("[scaffold.test] skipping integration test — CLI not built");
+      console.warn("[create_project.test] skipping integration test — CLI not built");
       return;
     }
     const target = join(scratch, "my-site");
-    const output = await ailkScaffold(
+    const output = await ailkCreateProject(
       { targetDir: target, projectName: "my-site" },
       CLI_PATH,
     );
@@ -204,7 +204,7 @@ describe("ailkScaffold handler", () => {
 
   it("rejects with a clear error when targetDir is non-empty", async () => {
     if (!existsSync(CLI_PATH)) {
-      console.warn("[scaffold.test] skipping integration test — CLI not built");
+      console.warn("[create_project.test] skipping integration test — CLI not built");
       return;
     }
     const target = join(scratch, "populated");
@@ -215,7 +215,7 @@ describe("ailkScaffold handler", () => {
     // the target exists and is non-empty. The MCP handler rejects with a
     // descriptive Error whose message matches the CLI stderr output.
     await expect(
-      ailkScaffold({ targetDir: target, projectName: "populated" }, CLI_PATH),
+      ailkCreateProject({ targetDir: target, projectName: "populated" }, CLI_PATH),
     ).rejects.toThrow(/non-empty|exists/i);
   });
 });
@@ -223,11 +223,11 @@ describe("ailkScaffold handler", () => {
 // ── Architectural guard ───────────────────────────────────────────────────────
 
 describe("architectural guard — no create-ailk direct import", () => {
-  it("apps/mcp/src/tools/scaffold.ts does not import create-ailk directly", async () => {
+  it("apps/mcp/src/tools/create_project.ts does not import create-ailk directly", async () => {
     const { readFileSync } = await import("node:fs");
     const { resolve: res } = await import("node:path");
     const src = readFileSync(
-      res(__dirname, "../../src/tools/scaffold.ts"),
+      res(__dirname, "../../src/tools/create_project.ts"),
       "utf-8",
     );
     // Must not have a static import of create-ailk or its dist