create-ailk 0.5.0 → 0.6.0

package/templates/apps/api/src/services/__tests__/deliverable-fulfillment.test.ts

@@ -33,6 +33,7 @@ jest.mock("@working-theory/observability", () => ({
 import { prisma } from "../../lib/prisma.js";
 import {
   fulfillDeliverable,
+  listSendlessGrants,
   type FulfillDeliverableInput,
 } from "../deliverable-fulfillment";
 
@@ -45,6 +46,17 @@ const SESSION_ID = "flsess_00000000-0000-7000-8000-0000000000c1";
 const LEAD_ID = "lead_00000000-0000-7000-8000-0000000000e1";
 const GRANT_ID = "dgrant_00000000-0000-7000-8000-0000000000g1";
 
+// #6257 — the seeded sentinel workspace the `"default"` alias resolves to
+// (`@working-theory/database/tenancy`'s DEFAULT_WORKSPACE_ID), with a
+// sentinel-shaped organizationId so `resolveSentinelWorkspaceRow`'s own
+// `isSentinel` check passes. Used by ONE test — the `listSendlessGrants`
+// resolution test, the only test in this file that exercises an alias at
+// all — to prove that read scopes by the id it RESOLVED rather than by the
+// alias string the CLI was given. The other fence tests below run no
+// resolution: `fulfillDeliverable` is handed an already-resolved id.
+const SENTINEL_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000001";
+const SENTINEL_ORGANIZATION_ID = "org_00000000-0000-7000-8000-000000000001";
+
 function deliverablesBlock() {
   return {
     assets: [
@@ -122,7 +134,12 @@ describe("fulfillDeliverable", () => {
 
     expect(prisma.deliverableAsset.findUnique).toHaveBeenCalledWith(
       expect.objectContaining({
-        where: { siteId_key: { siteId: SITE_ID, key: "guide-small" } },
+        where: {
+          siteId_key: { siteId: SITE_ID, key: "guide-small" },
+          // #6257 — the legacy store's read is fenced by the same resolved
+          // workspace id the grant is minted under.
+          workspaceId: SITE_ID,
+        },
       }),
     );
   });
@@ -138,7 +155,10 @@ describe("fulfillDeliverable", () => {
 
     expect(prisma.deliverableAsset.findUnique).toHaveBeenCalledWith(
       expect.objectContaining({
-        where: { siteId_key: { siteId: SITE_ID, key: "guide-large" } },
+        where: {
+          siteId_key: { siteId: SITE_ID, key: "guide-large" },
+          workspaceId: SITE_ID,
+        },
       }),
     );
   });
@@ -148,7 +168,10 @@ describe("fulfillDeliverable", () => {
 
     expect(prisma.deliverableAsset.findUnique).toHaveBeenCalledWith(
       expect.objectContaining({
-        where: { siteId_key: { siteId: SITE_ID, key: "guide-default" } },
+        where: {
+          siteId_key: { siteId: SITE_ID, key: "guide-default" },
+          workspaceId: SITE_ID,
+        },
       }),
     );
   });
@@ -158,7 +181,10 @@ describe("fulfillDeliverable", () => {
 
     expect(prisma.deliverableAsset.findUnique).toHaveBeenCalledWith(
       expect.objectContaining({
-        where: { siteId_key: { siteId: SITE_ID, key: "guide-default" } },
+        where: {
+          siteId_key: { siteId: SITE_ID, key: "guide-default" },
+          workspaceId: SITE_ID,
+        },
       }),
     );
   });
@@ -178,6 +204,9 @@ describe("fulfillDeliverable", () => {
     );
 
     expect(prisma.deliverableAsset.findUnique).not.toHaveBeenCalled();
+    // #6310 FR8: a no_entry resolution exits before EITHER store is read.
+    expect(prisma.flowDefinition.findUnique).not.toHaveBeenCalled();
+    expect(prisma.asset.findFirst).not.toHaveBeenCalled();
     expect(prisma.deliverableGrant.create).not.toHaveBeenCalled();
     expect(mockSendDeliverableEmail).not.toHaveBeenCalled();
     // AC4: no_entry is a pre-mint outcome — no grant exists to stamp.
@@ -234,7 +263,13 @@ describe("fulfillDeliverable", () => {
 
     expect(prisma.playbookInstance.findFirst).toHaveBeenCalledWith(
       expect.objectContaining({
-        where: { siteId: SITE_ID, leadId: LEAD_ID, experimentKey: "targeting-maturity" },
+        where: {
+          siteId: SITE_ID,
+          // #6257 — the playbook existence check is fenced too.
+          workspaceId: SITE_ID,
+          leadId: LEAD_ID,
+          experimentKey: "targeting-maturity",
+        },
       }),
     );
     expect(prisma.deliverableAsset.findUnique).not.toHaveBeenCalled();
@@ -296,6 +331,166 @@ describe("fulfillDeliverable", () => {
     expect(prisma.deliverableAsset.findUnique).toHaveBeenCalled();
   });
 
+  it("a playbook: deliverable issues zero Asset or FlowDefinition reads (#6310 FR8)", async () => {
+    (prisma.playbookInstance.findFirst as jest.Mock).mockResolvedValue({
+      id: "pbk_00000000-0000-7000-8000-0000000000p1",
+    });
+
+    await fulfillDeliverable(
+      baseInput({ segment: undefined, configSnapshot: playbookConfigSnapshot() }),
+    );
+
+    expect(prisma.flowDefinition.findUnique).not.toHaveBeenCalled();
+    expect(prisma.asset.findFirst).not.toHaveBeenCalled();
+  });
+
+  // ── #6310 D1/D2/D4/D5/D15 — Asset-first resolution ───────────────────────
+
+  const WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000001";
+  const OTHER_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000002";
+  const NEW_ASSET_ID = "asset_00000000-0000-7000-8000-0000000000b1";
+
+  it("resolves against the workspace Asset store first, and mints the grant with the asset_ id AND workspaceId (D1/D2/D15)", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
+      workspaceId: WORKSPACE_ID,
+    });
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({ id: NEW_ASSET_ID });
+
+    await fulfillDeliverable(baseInput());
+
+    expect(prisma.flowDefinition.findUnique).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { siteId_slug: { siteId: SITE_ID, slug: "get-a-quote" } },
+        select: { workspaceId: true },
+      }),
+    );
+    expect(prisma.asset.findFirst).toHaveBeenCalledWith({
+      where: { workspaceId: WORKSPACE_ID, key: "guide-small" },
+      select: { id: true },
+    });
+    expect(prisma.deliverableAsset.findUnique).not.toHaveBeenCalled();
+    expect(prisma.deliverableGrant.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({
+          siteId: SITE_ID,
+          assetId: NEW_ASSET_ID,
+          workspaceId: WORKSPACE_ID,
+          leadId: LEAD_ID,
+          sessionId: SESSION_ID,
+        }),
+      }),
+    );
+  });
+
+  it("falls back to the legacy DeliverableAsset store on an Asset miss, and mints a grant with NO workspaceId (D2/D3)", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
+      workspaceId: WORKSPACE_ID,
+    });
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
+
+    await fulfillDeliverable(baseInput());
+
+    expect(prisma.deliverableAsset.findUnique).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: {
+          siteId_key: { siteId: SITE_ID, key: "guide-small" },
+          // #6257 — the legacy store's read is fenced by the same resolved
+          // workspace id the grant is minted under.
+          workspaceId: SITE_ID,
+        },
+      }),
+    );
+    const [[createArgs]] = (prisma.deliverableGrant.create as jest.Mock).mock
+      .calls as [[{ data: Record<string, unknown> }]];
+    expect(createArgs.data["assetId"]).toBe(
+      "dasset_00000000-0000-7000-8000-0000000000a1",
+    );
+    // #6374 D4 / AC-8 — this mint site now ALWAYS stamps `workspaceId`,
+    // including on the legacy `dasset_` arm this test exercises, and the
+    // value is the grant's own `siteId`. NULL remains the sentinel for the
+    // rows that already EXIST (the migration touches none of them); it is no
+    // longer the sentinel for a row this code mints, because a mint always
+    // knows its workspace. The download route is unaffected: it branches on
+    // the `assetId` PREFIX and consults `workspaceId` only on the `asset_`
+    // arm.
+    expect(createArgs.data["workspaceId"]).toBe(createArgs.data["siteId"]);
+    expect(createArgs.data["workspaceId"]).toBe(SITE_ID);
+  });
+
+  it("prefers the Asset match over an existing legacy DeliverableAsset row at the SAME key (D2 order)", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
+      workspaceId: WORKSPACE_ID,
+    });
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue({ id: NEW_ASSET_ID });
+    // beforeEach's default deliverableAsset.findUnique mock already resolves
+    // a row at this key — it must never even be consulted.
+
+    await fulfillDeliverable(baseInput());
+
+    expect(prisma.deliverableAsset.findUnique).not.toHaveBeenCalled();
+    expect(prisma.deliverableGrant.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({ assetId: NEW_ASSET_ID }),
+      }),
+    );
+  });
+
+  it("skips the Asset lookup entirely when the definition's workspaceId is null — never guesses one (D5)", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
+      workspaceId: null,
+    });
+
+    await fulfillDeliverable(baseInput());
+
+    expect(prisma.asset.findFirst).not.toHaveBeenCalled();
+    expect(prisma.deliverableAsset.findUnique).toHaveBeenCalled();
+  });
+
+  it("skips the Asset lookup entirely when no FlowDefinition row resolves (D5)", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue(null);
+
+    await fulfillDeliverable(baseInput());
+
+    expect(prisma.asset.findFirst).not.toHaveBeenCalled();
+    expect(prisma.deliverableAsset.findUnique).toHaveBeenCalled();
+  });
+
+  it("mints no grant and logs asset_missing when NEITHER store resolves the key", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
+      workspaceId: WORKSPACE_ID,
+    });
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
+    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(null);
+
+    await fulfillDeliverable(baseInput());
+
+    expect(prisma.deliverableGrant.create).not.toHaveBeenCalled();
+    expect(mockLoggerInfo).toHaveBeenCalledWith(
+      expect.objectContaining({ outcome: "asset_missing" }),
+      expect.any(String),
+    );
+  });
+
+  it("never reaches a key that exists only in ANOTHER workspace (NFR3) — the lookup is scoped to this flow's own workspaceId alone", async () => {
+    (prisma.flowDefinition.findUnique as jest.Mock).mockResolvedValue({
+      workspaceId: WORKSPACE_ID,
+    });
+    (prisma.asset.findFirst as jest.Mock).mockResolvedValue(null);
+    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue(null);
+
+    await fulfillDeliverable(baseInput());
+
+    expect(prisma.asset.findFirst).toHaveBeenCalledWith({
+      where: { workspaceId: WORKSPACE_ID, key: "guide-small" },
+      select: { id: true },
+    });
+    expect(prisma.asset.findFirst).not.toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: expect.objectContaining({ workspaceId: OTHER_WORKSPACE_ID }),
+      }),
+    );
+  });
+
   // ── D5 — grant mint ───────────────────────────────────────────────────────
 
   it("mints the grant with assetId/leadId/sessionId", async () => {
@@ -521,3 +716,103 @@ describe("fulfillDeliverable", () => {
     );
   });
 });
+
+// ─── #6257 — the fence: every fenced read carries workspaceId ───────────────
+
+/**
+ * Unit C2's contract for this service (#6257 AC-1/AC-2). Three of its reads
+ * are workspace-scopable and are scoped here; the rest are keyed on the grant
+ * id itself — the capability token — and carry a global-key marker comment
+ * at the call site instead.
+ *
+ * `fulfillDeliverable`'s `siteId` is the session's own, resolved before it
+ * reaches this service (#6254/#6374 AC-7); `listSendlessGrants` takes an
+ * OPERATOR-SUPPLIED alias off the `deliverable:resend` CLI, so it resolves
+ * that alias itself and fails closed when it names no workspace.
+ */
+describe("#6257 — every fenced read carries workspaceId", () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env = {
+      ...originalEnv,
+      AILK_PUBLIC_API_URL: "https://api.example.com",
+      AILK_DELIVERABLE_EMAIL_FROM: "deliverable-default@example.com",
+    };
+    mockSendDeliverableEmail.mockResolvedValue({ ok: true, messageId: "msg-test" });
+    (prisma.deliverableAsset.findUnique as jest.Mock).mockResolvedValue({
+      id: "dasset_00000000-0000-7000-8000-0000000000a1",
+      siteId: SITE_ID,
+      key: "guide-small",
+    });
+    (prisma.deliverableGrant.create as jest.Mock).mockResolvedValue({ id: GRANT_ID });
+    (prisma.deliverableGrant.update as jest.Mock).mockResolvedValue({ id: GRANT_ID });
+    (prisma.deliverableGrant.findMany as jest.Mock).mockResolvedValue([]);
+  });
+
+  afterEach(() => {
+    process.env = originalEnv;
+  });
+
+  it("scopes the LEGACY DeliverableAsset lookup by the session's workspace id", async () => {
+    await fulfillDeliverable(baseInput());
+
+    const { where } = (prisma.deliverableAsset.findUnique as jest.Mock).mock.calls[0][0];
+    expect(where.workspaceId).toBe(SITE_ID);
+    expect(where.siteId_key).toEqual({ siteId: SITE_ID, key: "guide-small" });
+  });
+
+  it("scopes the PlaybookInstance existence check by the session's workspace id", async () => {
+    (prisma.playbookInstance.findFirst as jest.Mock).mockResolvedValue({ id: "pbk_1" });
+
+    await fulfillDeliverable(
+      baseInput({
+        segment: undefined,
+        configSnapshot: {
+          slug: "get-a-quote",
+          defaultLocale: "en",
+          steps: [],
+          deliverables: {
+            assets: [{ assetKey: "playbook:targeting-maturity" }],
+            copy: { subject: en("x"), body: en("y") },
+          },
+        },
+      }),
+    );
+
+    expect(
+      (prisma.playbookInstance.findFirst as jest.Mock).mock.calls[0][0].where.workspaceId,
+    ).toBe(SITE_ID);
+  });
+
+  it("listSendlessGrants resolves the CLI alias and scopes the list by the RESOLVED workspace id", async () => {
+    // The `"default"` alias resolves to the seeded sentinel workspace — the
+    // list must be scoped by THAT id, never by the alias string the operator
+    // typed on the command line. Passing the alias and asserting the SENTINEL
+    // id back is what discriminates a resolution from a passthrough: a test
+    // that passed the workspace id as the alias would assert the same string
+    // either way and could not fail (security review, round 1).
+    (prisma.workspace.findUnique as jest.Mock).mockImplementation(
+      async ({ where }: { where: { id: string } }) =>
+        where.id === SENTINEL_WORKSPACE_ID
+          ? { id: SENTINEL_WORKSPACE_ID, organizationId: SENTINEL_ORGANIZATION_ID }
+          : null,
+    );
+
+    await listSendlessGrants({ siteId: "default" });
+
+    const { where } = (prisma.deliverableGrant.findMany as jest.Mock).mock.calls[0][0];
+    expect(where.workspaceId).toBe(SENTINEL_WORKSPACE_ID);
+    expect(where.siteId).toBe(SENTINEL_WORKSPACE_ID);
+    expect(where.workspaceId).not.toBe("default");
+    expect(where.sendStatus).toBeNull();
+  });
+
+  it("listSendlessGrants fails closed on an alias that resolves to no workspace", async () => {
+    (prisma.workspace.findUnique as jest.Mock).mockResolvedValue(null);
+
+    await expect(listSendlessGrants({ siteId: "no-such-site" })).resolves.toEqual([]);
+    expect(prisma.deliverableGrant.findMany).not.toHaveBeenCalled();
+  });
+});

package/templates/apps/api/src/services/__tests__/deliverable-resend.test.ts

@@ -34,6 +34,10 @@ jest.mock("@working-theory/observability", () => ({
   },
 }));
 
+import {
+  mockNoWorkspace,
+  mockWorkspaceExists,
+} from "../../lib/__mocks__/prisma.js";
 import { prisma } from "../../lib/prisma.js";
 import {
   listSendlessGrants,
@@ -294,9 +298,25 @@ describe("resendDeliverableGrant", () => {
 describe("listSendlessGrants", () => {
   beforeEach(() => {
     jest.clearAllMocks();
+    // #6335 — the shared prisma mock no longer resolves a workspace for any
+    // id asked of it, so this describe states the one it expects.
+    // `listSendlessGrants` resolves its `--site` alias before it reads
+    // (#6257); without this the resolution returns null, the function
+    // returns [] early, and every assertion below would be vacuous.
+    mockWorkspaceExists(prisma, SITE_ID);
     (prisma.deliverableGrant.findMany as jest.Mock).mockResolvedValue([]);
   });
 
+  it("returns nothing and reads nothing when the site alias resolves to no workspace", async () => {
+    // The rejection path, so the explicit setup above is proven load-bearing
+    // rather than decorative (#6335 AC-6).
+    mockNoWorkspace(prisma);
+
+    await expect(listSendlessGrants({ siteId: SITE_ID })).resolves.toEqual([]);
+
+    expect(prisma.deliverableGrant.findMany).not.toHaveBeenCalled();
+  });
+
   // ── D4 — list mode selects on sendStatus: null + siteId, no send ────────
 
   it("selects on siteId + sendStatus: null and performs no send", async () => {