create-ailk 0.5.0 → 0.6.0

package/templates/apps/web/app/api/revalidate/__tests__/route.test.ts

@@ -0,0 +1,670 @@
+/**
+ * @jest-environment node
+ */
+
+/**
+ * Tests for the /api/revalidate receiver (#5877, spec
+ * docs/specs/5877-revalidate-receiver-spec.md).
+ *
+ * Contract (AC from the spec):
+ *   - AC-1 — a POST whose signature verifies against CONTENT_REVALIDATE_SECRET
+ *     calls revalidateTag exactly once for the page tag and once for the list
+ *     tag cache-tags.ts derives from the body, and returns 200. The signature
+ *     is produced here by an INDEPENDENT fake signer (node:crypto, never the
+ *     route's own helper), which is what makes the assertion meaningful.
+ *   - AC-2 — the 503 → 401 → 400 ladder (NFR2), each rung asserting that
+ *     revalidateTag was not called, and the unset-secret rung asserting
+ *     exactly one log line.
+ *   - AC-3 — the AC-WCE-02 publish-to-live harness, env-gated and SKIPPED by
+ *     default (D12). It needs a live CONTENT_ADAPTER=database deployment; see
+ *     the block at the bottom of this file.
+ *
+ * `next/cache` is mocked because the real revalidateTag throws
+ * "Invariant: static generation store missing" outside a Next server context
+ * (next@16.3.3 dist/server/web/spec-extension/revalidate.js:110-117) — and
+ * mocking it is also what lets "exactly once per tag" be asserted by call
+ * count (D11). The node environment is required because jsdom exposes no
+ * WHATWG Request/Response.
+ *
+ * Timing-safety (NFR1) is scored by ONE structural assertion plus code
+ * review; the spec does not claim more. No black-box input can distinguish a
+ * constant-time compare from a short-circuiting one, because a same-length
+ * wrong signature returns 401 either way. The assertion below is therefore a
+ * regression guard against a later edit, read off the route module's AST
+ * rather than by text grep — D3's own chosen code contains a legitimate `!==`
+ * between the two buffers' LENGTHS.
+ */
+
+// --- Mocks set up BEFORE imports ---
+
+jest.mock("next/cache", () => ({
+  __esModule: true,
+  revalidateTag: jest.fn(),
+}));
+
+import { createHmac } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { contentListTag, contentPageTag } from "@working-theory/page-renderer";
+import { revalidateTag } from "next/cache";
+import * as ts from "typescript";
+
+import { POST } from "../route";
+
+const mockRevalidateTag = revalidateTag as jest.Mock;
+
+// Deliberately low-entropy, dictionary-word fixtures: a random-looking value
+// here trips the repo's gitleaks `generic-api-key` rule, and an allowlist entry
+// for a fake secret would weaken the scan for a real one.
+const SECRET = "test-secret-the-right-one";
+const WRONG_SECRET = "test-secret-the-other-one";
+
+const VALID_BODY = {
+  workspaceId: "ws_fixture",
+  type: "Service",
+  slug: "some-slug",
+  locale: "en",
+};
+
+/**
+ * The fake signer — AC-1's "proved by test against a fake signer". It is the
+ * #5851 wire contract written out here independently: HMAC-SHA256 over the
+ * exact body bytes, lowercase hex, `sha256=` prefix.
+ */
+function sign(rawBody: string, secret: string): string {
+  return `sha256=${createHmac("sha256", secret).update(rawBody, "utf8").digest("hex")}`;
+}
+
+function makeRequest(opts: {
+  rawBody: string;
+  signature?: string;
+  event?: string;
+  requestId?: string;
+}): Request {
+  const headers: Record<string, string> = {
+    "content-type": "application/json",
+  };
+  if (opts.signature !== undefined) {
+    headers["x-ailk-revalidate-signature"] = opts.signature;
+  }
+  if (opts.event !== undefined) {
+    headers["x-ailk-revalidate-event"] = opts.event;
+  }
+  if (opts.requestId !== undefined) {
+    headers["x-request-id"] = opts.requestId;
+  }
+  return new Request("http://localhost/api/revalidate", {
+    method: "POST",
+    headers,
+    body: opts.rawBody,
+  });
+}
+
+/** A correctly-signed POST of `body` under `secret`. */
+function signedRequest(
+  body: unknown,
+  secret: string,
+  event = "publish",
+): Request {
+  const rawBody = JSON.stringify(body);
+  return makeRequest({ rawBody, signature: sign(rawBody, secret), event });
+}
+
+describe("POST /api/revalidate", () => {
+  const originalSecret = process.env.CONTENT_REVALIDATE_SECRET;
+
+  beforeEach(() => {
+    process.env.CONTENT_REVALIDATE_SECRET = SECRET;
+    mockRevalidateTag.mockClear();
+    jest.spyOn(console, "error").mockImplementation(() => {});
+    jest.spyOn(console, "warn").mockImplementation(() => {});
+    jest.spyOn(console, "info").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    if (originalSecret === undefined) {
+      delete process.env.CONTENT_REVALIDATE_SECRET;
+    } else {
+      process.env.CONTENT_REVALIDATE_SECRET = originalSecret;
+    }
+  });
+
+  // --- AC-1 ---------------------------------------------------------------
+
+  describe("AC-1 — a verified POST purges both tags and returns 200", () => {
+    it("returns 200 with { revalidated: true }", async () => {
+      const response = await POST(signedRequest(VALID_BODY, SECRET));
+
+      expect(response.status).toBe(200);
+      await expect(response.json()).resolves.toEqual({ revalidated: true });
+    });
+
+    it("calls revalidateTag exactly twice — once per tag, each with { expire: 0 }", async () => {
+      await POST(signedRequest(VALID_BODY, SECRET));
+
+      // The expected tags are obtained by CALLING cache-tags.ts's own builders,
+      // never typed as literals — which is what keeps the assertion independent
+      // of the {workspace} segment's value (D5).
+      const pageTag = contentPageTag({
+        type: VALID_BODY.type,
+        slug: VALID_BODY.slug,
+        locale: VALID_BODY.locale,
+      });
+      const listTag = contentListTag({ type: VALID_BODY.type });
+
+      expect(mockRevalidateTag).toHaveBeenCalledTimes(2);
+      expect(mockRevalidateTag).toHaveBeenCalledWith(pageTag, { expire: 0 });
+      expect(mockRevalidateTag).toHaveBeenCalledWith(listTag, { expire: 0 });
+    });
+
+    it("purges tags built from the body's own type/slug/locale", async () => {
+      const body = {
+        workspaceId: "ws_other",
+        type: "Article",
+        slug: "another-slug",
+        locale: "fr",
+      };
+
+      await POST(signedRequest(body, SECRET));
+
+      expect(mockRevalidateTag).toHaveBeenCalledWith(
+        contentPageTag({ type: "Article", slug: "another-slug", locale: "fr" }),
+        { expire: 0 },
+      );
+      expect(mockRevalidateTag).toHaveBeenCalledWith(
+        contentListTag({ type: "Article" }),
+        { expire: 0 },
+      );
+    });
+
+    it("treats publish and unpublish identically — one code path (FR7, D6)", async () => {
+      await POST(signedRequest(VALID_BODY, SECRET, "publish"));
+      const publishCalls = mockRevalidateTag.mock.calls;
+
+      mockRevalidateTag.mockClear();
+
+      const response = await POST(
+        signedRequest(VALID_BODY, SECRET, "unpublish"),
+      );
+
+      expect(response.status).toBe(200);
+      expect(mockRevalidateTag.mock.calls).toEqual(publishCalls);
+    });
+
+    it("accepts a request with no event header, logging it as unknown (FR7)", async () => {
+      const rawBody = JSON.stringify(VALID_BODY);
+      const response = await POST(
+        makeRequest({ rawBody, signature: sign(rawBody, SECRET) }),
+      );
+
+      expect(response.status).toBe(200);
+      expect(mockRevalidateTag).toHaveBeenCalledTimes(2);
+      expect(console.info).toHaveBeenCalledTimes(1);
+      expect((console.info as jest.Mock).mock.calls[0][0]).toContain("unknown");
+    });
+
+    it("is idempotent under retry — a second identical delivery purges the same tags (NFR3)", async () => {
+      await POST(signedRequest(VALID_BODY, SECRET));
+      const firstCalls = mockRevalidateTag.mock.calls;
+      mockRevalidateTag.mockClear();
+
+      const second = await POST(signedRequest(VALID_BODY, SECRET));
+
+      expect(second.status).toBe(200);
+      expect(mockRevalidateTag.mock.calls).toEqual(firstCalls);
+    });
+
+    it("logs one line prefixed [revalidate] carrying the correlation id (FR8, D8)", async () => {
+      const rawBody = JSON.stringify(VALID_BODY);
+      await POST(
+        makeRequest({
+          rawBody,
+          signature: sign(rawBody, SECRET),
+          event: "publish",
+          requestId: "req-abc-123",
+        }),
+      );
+
+      expect(console.info).toHaveBeenCalledTimes(1);
+      const line = (console.info as jest.Mock).mock.calls[0][0] as string;
+      expect(line).toContain("[revalidate]");
+      expect(line).toContain("req-abc-123");
+    });
+
+    it("never logs the secret or the signature header value (FR9)", async () => {
+      const rawBody = JSON.stringify(VALID_BODY);
+      const signature = sign(rawBody, SECRET);
+
+      await POST(makeRequest({ rawBody, signature, event: "publish" }));
+
+      const logged = [
+        ...(console.info as jest.Mock).mock.calls,
+        ...(console.warn as jest.Mock).mock.calls,
+        ...(console.error as jest.Mock).mock.calls,
+      ]
+        .flat()
+        .map((arg) => String(arg))
+        .join("\n");
+
+      expect(logged).not.toContain(SECRET);
+      expect(logged).not.toContain(signature);
+    });
+  });
+
+  // --- AC-1, NFR1: the structural timing-safety guard ---------------------
+
+  describe("NFR1 — the comparison is timing-safe", () => {
+    const sourceFile = ts.createSourceFile(
+      "route.ts",
+      readFileSync(join(__dirname, "..", "route.ts"), "utf8"),
+      ts.ScriptTarget.ESNext,
+    );
+
+    function walk(node: ts.Node, visit: (n: ts.Node) => void): void {
+      visit(node);
+      ts.forEachChild(node, (child) => walk(child, visit));
+    }
+
+    /** The base identifier of `a`, `a.b` or `a.b.c` — `undefined` otherwise. */
+    function baseIdentifier(node: ts.Node): string | undefined {
+      let current: ts.Node = node;
+      while (ts.isPropertyAccessExpression(current)) {
+        current = current.expression;
+      }
+      return ts.isIdentifier(current) ? current.text : undefined;
+    }
+
+    const isLengthAccess = (node: ts.Node): boolean =>
+      ts.isPropertyAccessExpression(node) && node.name.text === "length";
+
+    const EQUALITY_OPERATORS = new Set<ts.SyntaxKind>([
+      ts.SyntaxKind.EqualsEqualsEqualsToken,
+      ts.SyntaxKind.ExclamationEqualsEqualsToken,
+    ]);
+
+    // One traversal serves both tests below: the names timingSafeEqual is
+    // called with, every local declaration's initialiser, and every strict
+    // equality comparison in the module.
+    const comparedNames: string[] = [];
+    const declaredFrom = new Map<string, string[]>();
+    const equalities: ts.BinaryExpression[] = [];
+
+    walk(sourceFile, (node) => {
+      if (
+        ts.isCallExpression(node) &&
+        baseIdentifier(node.expression) === "timingSafeEqual"
+      ) {
+        for (const arg of node.arguments) {
+          const name = baseIdentifier(arg);
+          if (name !== undefined) comparedNames.push(name);
+        }
+        return;
+      }
+      if (
+        ts.isVariableDeclaration(node) &&
+        ts.isIdentifier(node.name) &&
+        node.initializer !== undefined
+      ) {
+        const reads: string[] = [];
+        walk(node.initializer, (inner) => {
+          if (ts.isIdentifier(inner)) reads.push(inner.text);
+        });
+        declaredFrom.set(node.name.text, reads);
+        return;
+      }
+      if (
+        ts.isBinaryExpression(node) &&
+        EQUALITY_OPERATORS.has(node.operatorToken.kind)
+      ) {
+        equalities.push(node);
+      }
+    });
+
+    /**
+     * The names that carry the two signature VALUES: what `timingSafeEqual` is
+     * called with, plus the locals whose initialisers those bindings are built
+     * from — one hop, which is what separates `expectedBuf`/`providedBuf` from
+     * the strings behind them. Derived from the AST, never hard-coded, so a
+     * rename cannot silently defeat the guard.
+     */
+    function signatureValueNames(): Set<string> {
+      const names = new Set(comparedNames);
+      for (const compared of comparedNames) {
+        for (const read of declaredFrom.get(compared) ?? []) {
+          if (declaredFrom.has(read)) names.add(read);
+        }
+      }
+      return names;
+    }
+
+    it("calls timingSafeEqual", () => {
+      expect(comparedNames.length).toBeGreaterThan(0);
+    });
+
+    it("compares no two signature values with === or !== (only their lengths)", () => {
+      const names = signatureValueNames();
+      expect(names.size).toBeGreaterThan(0);
+
+      const offenders = equalities
+        .filter((node) => {
+          const left = baseIdentifier(node.left);
+          const right = baseIdentifier(node.right);
+          return (
+            left !== undefined &&
+            right !== undefined &&
+            names.has(left) &&
+            names.has(right) &&
+            !isLengthAccess(node.left) &&
+            !isLengthAccess(node.right)
+          );
+        })
+        .map((node) => node.getText(sourceFile));
+
+      expect(offenders).toEqual([]);
+    });
+  });
+
+  // --- AC-2 ---------------------------------------------------------------
+
+  describe("AC-2 — the 503 → 401 → 400 ladder, never revalidating unsigned", () => {
+    it("returns 503 and logs exactly once with the secret unset, without revalidating (FR2, D10)", async () => {
+      delete process.env.CONTENT_REVALIDATE_SECRET;
+
+      const response = await POST(signedRequest(VALID_BODY, SECRET));
+
+      expect(response.status).toBe(503);
+      await expect(response.json()).resolves.toEqual({
+        error: "not_configured",
+      });
+      expect(mockRevalidateTag).not.toHaveBeenCalled();
+      expect(console.error).toHaveBeenCalledTimes(1);
+    });
+
+    it("returns 503 with the secret set to the empty string (FR2)", async () => {
+      process.env.CONTENT_REVALIDATE_SECRET = "";
+
+      const response = await POST(signedRequest(VALID_BODY, SECRET));
+
+      expect(response.status).toBe(503);
+      expect(mockRevalidateTag).not.toHaveBeenCalled();
+    });
+
+    it("returns 401 when the signature header is absent", async () => {
+      const response = await POST(
+        makeRequest({
+          rawBody: JSON.stringify(VALID_BODY),
+          event: "publish",
+        }),
+      );
+
+      expect(response.status).toBe(401);
+      await expect(response.json()).resolves.toEqual({
+        error: "invalid_signature",
+      });
+      expect(mockRevalidateTag).not.toHaveBeenCalled();
+    });
+
+    it("returns 401 when the signature header is malformed", async () => {
+      const rawBody = JSON.stringify(VALID_BODY);
+
+      for (const malformed of [
+        "not-a-signature",
+        "sha256=short",
+        `sha1=${"a".repeat(64)}`,
+        `sha256=${"A".repeat(64)}`, // uppercase hex is not the wire encoding
+        sign(rawBody, SECRET).slice("sha256=".length), // prefix stripped
+      ]) {
+        mockRevalidateTag.mockClear();
+
+        const response = await POST(
+          makeRequest({ rawBody, signature: malformed, event: "publish" }),
+        );
+
+        expect(response.status).toBe(401);
+        expect(mockRevalidateTag).not.toHaveBeenCalled();
+      }
+    });
+
+    it("returns 401 for a correctly-shaped signature made with the wrong key", async () => {
+      const response = await POST(signedRequest(VALID_BODY, WRONG_SECRET));
+
+      expect(response.status).toBe(401);
+      expect(mockRevalidateTag).not.toHaveBeenCalled();
+    });
+
+    it("returns 401 when the body was altered after signing", async () => {
+      const signedOver = JSON.stringify(VALID_BODY);
+      const delivered = JSON.stringify({ ...VALID_BODY, slug: "tampered" });
+
+      const response = await POST(
+        makeRequest({
+          rawBody: delivered,
+          signature: sign(signedOver, SECRET),
+          event: "publish",
+        }),
+      );
+
+      expect(response.status).toBe(401);
+      expect(mockRevalidateTag).not.toHaveBeenCalled();
+    });
+
+    it("returns 400 for a correctly-signed body that is not four-key JSON", async () => {
+      for (const rawBody of [
+        "not json at all",
+        "[]",
+        "null",
+        '"a string"',
+        JSON.stringify({ type: "Service", slug: "s", locale: "en" }), // no workspaceId
+        JSON.stringify({ ...VALID_BODY, locale: 42 }), // locale not a string
+      ]) {
+        mockRevalidateTag.mockClear();
+
+        const response = await POST(
+          makeRequest({
+            rawBody,
+            signature: sign(rawBody, SECRET),
+            event: "publish",
+          }),
+        );
+
+        expect(response.status).toBe(400);
+        await expect(response.json()).resolves.toEqual({
+          error: "invalid_body",
+        });
+        expect(mockRevalidateTag).not.toHaveBeenCalled();
+      }
+    });
+
+    it("prefers 401 over 400 — a wrong-key request with a malformed body is 401, never 400 (NFR2)", async () => {
+      const rawBody = "not json at all";
+
+      const response = await POST(
+        makeRequest({
+          rawBody,
+          signature: sign(rawBody, WRONG_SECRET),
+          event: "publish",
+        }),
+      );
+
+      expect(response.status).toBe(401);
+      await expect(response.json()).resolves.toEqual({
+        error: "invalid_signature",
+      });
+      expect(mockRevalidateTag).not.toHaveBeenCalled();
+    });
+
+    it("reads the secret per request, not at module load (D10)", async () => {
+      // The module was imported with whatever the ambient env held. Rotating
+      // the value between two calls, with no jest.resetModules(), is only
+      // observable if the read happens inside the handler.
+      delete process.env.CONTENT_REVALIDATE_SECRET;
+      expect((await POST(signedRequest(VALID_BODY, SECRET))).status).toBe(503);
+
+      process.env.CONTENT_REVALIDATE_SECRET = SECRET;
+      expect((await POST(signedRequest(VALID_BODY, SECRET))).status).toBe(200);
+    });
+  });
+});
+
+// --- AC-3: the AC-WCE-02 publish-to-live harness (D12) --------------------
+
+/**
+ * Env-gated and SKIPPED by default. It needs a live CONTENT_ADAPTER=database
+ * deployment, a reachable apps/api and a workspace token — none of which a CI
+ * job or a developer machine has, so running it unconditionally would be red
+ * for infrastructure reasons on every PR (D12). Run it by hand:
+ *
+ *   RUN_WCE02_HARNESS=1 \
+ *   WCE02_SITE_URL=https://<fixture-site> \
+ *   WCE02_API_URL=https://<fixture-api> \
+ *   WCE02_WORKSPACE_ID=<id> \
+ *   WCE02_API_TOKEN=<token> \
+ *     pnpm --filter @working-theory/web test -- app/api/revalidate
+ *
+ * Paste the ten elapsed-ms samples and the computed p95 into the PR body's
+ * ## Verification block; AC-3 is scored on that paste and on nothing else.
+ *
+ * Idiom: packages/create-ailk/__tests__/paid-module-honest-states.test.ts:510.
+ */
+const describeHarness =
+  process.env["RUN_WCE02_HARNESS"] === "1" ? describe : describe.skip;
+
+const HARNESS_ENV = [
+  "WCE02_SITE_URL",
+  "WCE02_API_URL",
+  "WCE02_WORKSPACE_ID",
+  "WCE02_API_TOKEN",
+] as const;
+
+const HARNESS_RUNS = 10;
+const HARNESS_BUDGET_MS = 60_000;
+const HARNESS_POLL_INTERVAL_MS = 1_000;
+
+describeHarness(
+  "AC-3 / AC-WCE-02 — publish-to-live p95 ≤ 60 s on the fixture site",
+  () => {
+    function requireEnv(): Record<(typeof HARNESS_ENV)[number], string> {
+      const missing = HARNESS_ENV.filter(
+        (name) => (process.env[name] ?? "") === "",
+      );
+      if (missing.length > 0) {
+        throw new Error(
+          `RUN_WCE02_HARNESS=1 but these are unset: ${missing.join(", ")}. ` +
+            `The harness needs a live CONTENT_ADAPTER=database deployment; see D12.`,
+        );
+      }
+      return Object.fromEntries(
+        HARNESS_ENV.map((name) => [name, process.env[name] as string]),
+      ) as Record<(typeof HARNESS_ENV)[number], string>;
+    }
+
+    const FIXTURE_TYPE = process.env["WCE02_TYPE"] ?? "Service";
+    const FIXTURE_SLUG = process.env["WCE02_SLUG"] ?? "wce02-fixture";
+    const FIXTURE_LOCALE = process.env["WCE02_LOCALE"] ?? "en";
+    const publicUrl = (siteUrl: string): string =>
+      `${siteUrl.replace(/\/$/, "")}/${FIXTURE_LOCALE}/${FIXTURE_TYPE.toLowerCase()}/${FIXTURE_SLUG}`;
+
+    /**
+     * One resolution of the fixture target, so the API path template
+     * `/v1/workspaces/{id}/content/{type}/{slug}` and the auth headers are
+     * written once — an API route change cannot break one of the two tests
+     * below and not the other.
+     */
+    function harnessTarget(): {
+      contentPath: string;
+      authHeaders: Record<string, string>;
+      siteUrl: string;
+    } {
+      const env = requireEnv();
+      const api = env.WCE02_API_URL.replace(/\/$/, "");
+      return {
+        contentPath: `${api}/v1/workspaces/${env.WCE02_WORKSPACE_ID}/content/${FIXTURE_TYPE}/${FIXTURE_SLUG}`,
+        authHeaders: {
+          authorization: `Bearer ${env.WCE02_API_TOKEN}`,
+          "content-type": "application/json",
+        },
+        siteUrl: env.WCE02_SITE_URL,
+      };
+    }
+
+    /** Polls the public URL until `predicate` holds or the budget elapses. */
+    async function pollUntil(
+      url: string,
+      predicate: (body: string) => boolean,
+    ): Promise<number> {
+      const startedAt = Date.now();
+      for (;;) {
+        const response = await fetch(url, { cache: "no-store" });
+        // Always drained, ok or not: an unconsumed body holds the socket until
+        // GC, and the unpublish poll hits the not-ok branch by design.
+        const text = await response.text();
+        const body = response.ok ? text : "";
+        if (predicate(body)) return Date.now() - startedAt;
+        if (Date.now() - startedAt >= HARNESS_BUDGET_MS) {
+          throw new Error(
+            `${url} did not converge within ${HARNESS_BUDGET_MS} ms`,
+          );
+        }
+        await new Promise((resolve) =>
+          setTimeout(resolve, HARNESS_POLL_INTERVAL_MS),
+        );
+      }
+    }
+
+    it(`publishes ${HARNESS_RUNS} times with no deploy and observes each within ${HARNESS_BUDGET_MS} ms`, async () => {
+      const { contentPath, authHeaders, siteUrl } = harnessTarget();
+      const samples: number[] = [];
+
+      for (let run = 0; run < HARNESS_RUNS; run += 1) {
+        const marker = `wce02-${Date.now()}-${run}`;
+
+        const draft = await fetch(contentPath, {
+          method: "PATCH",
+          headers: authHeaders,
+          body: JSON.stringify({ body: `# ${marker}\n` }),
+        });
+        expect(draft.ok).toBe(true);
+
+        const published = await fetch(`${contentPath}/publish`, {
+          method: "POST",
+          headers: authHeaders,
+        });
+        expect(published.ok).toBe(true);
+
+        samples.push(
+          await pollUntil(publicUrl(siteUrl), (body) => body.includes(marker)),
+        );
+      }
+
+      // Nearest-rank p95 over ten samples is ceil(0.95 × 10) = 10 — the
+      // tenth, i.e. the maximum. So the criterion reduces to "every run
+      // within 60 s" (D12).
+      const p95 = Math.max(...samples);
+      console.info(
+        `[wce02] samples(ms)=${samples.join(",")} p95=${p95} budget=${HARNESS_BUDGET_MS}`,
+      );
+
+      expect(p95).toBeLessThanOrEqual(HARNESS_BUDGET_MS);
+    }, 90_000);
+
+    it(`unpublishes and observes the page stop serving within ${HARNESS_BUDGET_MS} ms`, async () => {
+      const { contentPath, authHeaders, siteUrl } = harnessTarget();
+
+      const unpublished = await fetch(`${contentPath}/unpublish`, {
+        method: "POST",
+        headers: authHeaders,
+      });
+      expect(unpublished.ok).toBe(true);
+
+      const elapsed = await pollUntil(
+        publicUrl(siteUrl),
+        (body) => body === "",
+      );
+      console.info(`[wce02] unpublish elapsed(ms)=${elapsed}`);
+
+      expect(elapsed).toBeLessThanOrEqual(HARNESS_BUDGET_MS);
+    }, 90_000);
+  },
+);