create-ailk 0.5.0 → 0.6.1

package/templates/apps/api/src/middleware/__tests__/default-tenant.test.ts

@@ -33,12 +33,15 @@ import { prisma } from "../../lib/prisma.js";
 import type { Id } from "@working-theory/ids";
 
 import { defaultTenantPreHandlerPlugin } from "../default-tenant.js";
+import { resolveDefaultTenant } from "../../services/default-tenant.js";
 
 // The reserved-range sentinel values from database/tenancy.ts (ADR-0031
 // rule 7) — re-declared here as literals so the test pins the WIRE values,
 // not whatever the constants happen to be.
 const DEFAULT_ORG_ID = "org_00000000-0000-7000-8000-000000000001";
 const DEFAULT_WORKSPACE_ID = "wksp_00000000-0000-7000-8000-000000000001";
+const OPERATOR_MEMBERSHIP_ID =
+  "member_00000000-0000-7000-8000-000000000001";
 
 /** A workspace id belonging to somebody else — never this caller's. */
 const FOREIGN_WORKSPACE_ID = "wksp_01936b2c-0000-7000-8000-00000000beef";
@@ -103,6 +106,12 @@ function buildApp(
   app.get("/workspaces/:workspaceId/config", async (req) => ({
     workspaceId: req.tenant?.workspaceId ?? null,
   }));
+  // The `workspace` module's settings-route GET shape (#5371) — the surface
+  // #5515 item 1 asks about. Stubbed rather than imported: what is under test
+  // is which tenant the GUARD yields to it, not what the handler then reads.
+  app.get("/workspaces/:workspaceId/general", async (req) => ({
+    workspaceId: req.tenant?.workspaceId ?? null,
+  }));
   return app;
 }
 
@@ -120,6 +129,75 @@ afterAll(() => {
   process.env = ORIGINAL_ENV;
 });
 
+/**
+ * #5515 item 1 — `AILK_OPERATOR_EMAIL` is REQUIRED for a workspace-module
+ * deployment, and that requirement is what keeps the TOFU operator bind from
+ * firing on a settings-route GET.
+ *
+ * The #5513 review raised this against `apps/api/src/services/tenant-context.ts`
+ * before #5677 moved the resolution: registering the `workspace` module's
+ * routes under `isModuleEnabled("workspace") || isModuleEnabled("multi-tenant")`
+ * put a `tenantPreHandler` route on a build that has no multi-tenant module,
+ * so the concern was that the first authenticated account to load the module's
+ * Admin pages (`/admin`, renamed from `/workspace` by #5637) would TOFU-bind
+ * itself as org owner off a plain settings GET.
+ *
+ * On a workspace-only build `server.ts`'s `tenantPreHandlerForBuild()` picks
+ * THIS guard, which calls `resolveDefaultTenantForOperator` — so the pin is
+ * mandatory and unset fails CLOSED. These two cases are the objective record
+ * of that, pinned to the settings-route shape rather than the review surface:
+ * with the pin unset the bind never runs and the route is 403 to everyone;
+ * with it set, only the pinned operator is seated. The documentation half of
+ * this item is `.env.example` and `apps/api/CLAUDE.md`. Redesigning #3631's
+ * TOFU was explicitly out of scope.
+ */
+describe("workspace-module settings route — the operator pin is required (#5515 item 1)", () => {
+  const settingsPath = `/workspaces/${DEFAULT_WORKSPACE_ID}/general`;
+
+  it("DENIES a settings-route GET when AILK_OPERATOR_EMAIL is UNSET — and the TOFU bind never fires", async () => {
+    delete process.env.AILK_OPERATOR_EMAIL;
+    mockSingleTenantWorkspace();
+    mockBoundOperator();
+
+    const app = buildApp();
+    const res = await app.inject({ method: "GET", url: settingsPath });
+
+    expect(res.statusCode).toBe(403);
+    // The load-bearing assertion: no Membership is minted off a settings GET.
+    expect(prisma.membership.create).not.toHaveBeenCalled();
+    await app.close();
+  });
+
+  it("GRANTS the same settings-route GET once AILK_OPERATOR_EMAIL pins the caller", async () => {
+    process.env.AILK_OPERATOR_EMAIL = OPERATOR_EMAIL;
+    mockSingleTenantWorkspace();
+    mockBoundOperator();
+
+    const app = buildApp();
+    const res = await app.inject({ method: "GET", url: settingsPath });
+
+    expect(res.statusCode).toBe(200);
+    expect(res.json()).toEqual({ workspaceId: DEFAULT_WORKSPACE_ID });
+    await app.close();
+  });
+
+  it("DENIES a settings-route GET from a caller who is NOT the pinned operator, minting nothing", async () => {
+    process.env.AILK_OPERATOR_EMAIL = OPERATOR_EMAIL;
+    mockSingleTenantWorkspace();
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
+      email: "first-visitor@example.com",
+      emailVerified: true,
+    });
+
+    const app = buildApp();
+    const res = await app.inject({ method: "GET", url: settingsPath });
+
+    expect(res.statusCode).toBe(403);
+    expect(prisma.membership.create).not.toHaveBeenCalled();
+    await app.close();
+  });
+});
+
 describe("default tenant guard — isolation (#5677)", () => {
   it("DENIES a foreign workspaceId with 403, before any lookup of the target", async () => {
     mockSingleTenantWorkspace();
@@ -337,3 +415,107 @@ describe("default tenant guard — isolation (#5677)", () => {
     await app.close();
   });
 });
+
+/**
+ * The MULTI-TENANT reach into the same bind (#5701 AC-2). `resolveActiveTenant`
+ * (`services/tenant-context.ts:89`) calls `resolveDefaultTenant` directly, so
+ * `bindOperatorMembership` is reached WITHOUT the verified-email gate that
+ * `resolveDefaultTenantForOperator` — the base-build entry the guard above
+ * exercises — applies first. These cases drive that entry point directly,
+ * which is the only way to observe the bind's own check; through the plugin
+ * the wrapper would refuse first and the assertion would prove nothing.
+ */
+describe("resolveDefaultTenant — the operator bind's own verified-email check (#5701)", () => {
+  it("does NOT create the Membership when the pinned address matches but emailVerified is false", async () => {
+    mockSingleTenantWorkspace();
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
+      id: USER_ID,
+      email: OPERATOR_EMAIL,
+      emailVerified: false,
+    });
+    (prisma.membership.findUnique as jest.Mock).mockResolvedValue(null);
+
+    const result = await resolveDefaultTenant(USER_ID);
+
+    expect(result).toBeNull();
+    // The bind is the escalation: an unverified address is an unproven claim
+    // to the pin, so no `owner` Membership may be minted from it.
+    expect(prisma.membership.create).not.toHaveBeenCalled();
+  });
+
+  it("does NOT create the Membership when the pinned caller has no User row", async () => {
+    mockSingleTenantWorkspace();
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue(null);
+    (prisma.membership.findUnique as jest.Mock).mockResolvedValue(null);
+
+    const result = await resolveDefaultTenant(USER_ID);
+
+    expect(result).toBeNull();
+    expect(prisma.membership.create).not.toHaveBeenCalled();
+  });
+
+  it("CREATES the Membership when the pinned address matches and emailVerified is true — unchanged behaviour", async () => {
+    mockSingleTenantWorkspace();
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
+      id: USER_ID,
+      email: OPERATOR_EMAIL,
+      emailVerified: true,
+    });
+    (prisma.membership.create as jest.Mock).mockResolvedValue({});
+    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
+      role: "owner",
+    });
+
+    const result = await resolveDefaultTenant(USER_ID);
+
+    expect(prisma.membership.create).toHaveBeenCalledTimes(1);
+    expect((prisma.membership.create as jest.Mock).mock.calls[0]?.[0]).toEqual({
+      data: {
+        id: OPERATOR_MEMBERSHIP_ID,
+        organizationId: DEFAULT_ORG_ID,
+        userId: USER_ID,
+        role: "owner",
+      },
+    });
+    expect(result).toEqual({
+      userId: USER_ID,
+      organizationId: DEFAULT_ORG_ID,
+      workspaceId: DEFAULT_WORKSPACE_ID,
+      role: "owner",
+    });
+  });
+
+  it("leaves the UNPINNED branch untouched — no User read, pure TOFU bind (#5701 D4)", async () => {
+    delete process.env.AILK_OPERATOR_EMAIL;
+    mockSingleTenantWorkspace();
+    (prisma.membership.create as jest.Mock).mockResolvedValue({});
+    (prisma.membership.findUnique as jest.Mock).mockResolvedValue({
+      role: "owner",
+    });
+
+    const result = await resolveDefaultTenant(USER_ID);
+
+    // No pin means no email comparison at all — the bind stays first-caller-wins.
+    expect(prisma.user.findUnique).not.toHaveBeenCalled();
+    expect(prisma.membership.create).toHaveBeenCalledTimes(1);
+    expect(result).toEqual({
+      userId: USER_ID,
+      organizationId: DEFAULT_ORG_ID,
+      workspaceId: DEFAULT_WORKSPACE_ID,
+      role: "owner",
+    });
+  });
+
+  it("still swallows the OPERATOR_MEMBERSHIP_ID unique violation — the TOFU race is unchanged", async () => {
+    mockSingleTenantWorkspace();
+    (prisma.user.findUnique as jest.Mock).mockResolvedValue({
+      id: USER_ID,
+      email: OPERATOR_EMAIL,
+      emailVerified: true,
+    });
+    (prisma.membership.create as jest.Mock).mockRejectedValue({ code: "P2002" });
+    (prisma.membership.findUnique as jest.Mock).mockResolvedValue(null);
+
+    await expect(resolveDefaultTenant(USER_ID)).resolves.toBeNull();
+  });
+});

package/templates/apps/api/src/middleware/__tests__/rate-limit.test.ts

@@ -485,3 +485,45 @@ describe("cross-isolate limit — does NOT hold by design (#5040, SINGLE-REPLICA
     }
   });
 });
+
+// #6019 AC-2 — the `pathOnly` split (#5970 security review, finding 1): a
+// route may carry its credential in the query string
+// (`/v1/requests/:id/confirm?token=…` does), and a 429 is a line an attacker
+// can provoke at will by tripping the limiter — logging the raw target would
+// let them farm credentials out of the operator's own log that way.
+describe("rate-limit warn log — no query-string credential (#5970)", () => {
+  it("scrubs the query string from the logged path on a 429", async () => {
+    __resetBuckets();
+    const logLines: Array<Record<string, unknown>> = [];
+    const app = Fastify({
+      trustProxy: true,
+      logger: {
+        level: "warn",
+        stream: {
+          write(msg: string) {
+            logLines.push(JSON.parse(msg) as Record<string, unknown>);
+          },
+        },
+      },
+    });
+    app.register(rateLimitMiddleware, { perIpPerMinute: 1 });
+    app.get("/v1/requests/:id/confirm", async () => ({ ok: true }));
+    await app.ready();
+
+    try {
+      const url = "/v1/requests/callbk_1/confirm?token=SUPERSECRETTOKEN";
+      const headers = { "x-forwarded-for": "1.2.3.4" };
+      await app.inject({ method: "GET", url, headers });
+      const limited = await app.inject({ method: "GET", url, headers });
+      expect(limited.statusCode).toBe(429);
+
+      const logged = logLines.find((line) => line["msg"] === "rate_limited");
+      expect(logged?.["path"]).toBe("/v1/requests/callbk_1/confirm");
+      const text = JSON.stringify(logLines);
+      expect(text).not.toContain("SUPERSECRETTOKEN");
+      expect(text).not.toContain("token=");
+    } finally {
+      await app.close();
+    }
+  });
+});

package/templates/apps/api/src/middleware/rate-limit.ts

@@ -187,7 +187,13 @@ export const rateLimitMiddleware: FastifyPluginCallback<RateLimitOptions> = (
         // Evict stale buckets on every 429 to cap memory under abuse.
         evictStaleBuckets(now, windowMs);
 
-        req.log.warn({ ip, path: req.url, count: bucket.count }, RATE_LIMITED);
+        // The path WITHOUT its query string (#5970 security review, finding 1): a
+        // route may carry its credential there (`/v1/requests/:id/confirm?token=…`
+        // does), and a rate-limit warning is a line an attacker can provoke at
+        // will — logging the raw target would let them farm credentials out of
+        // the operator's own log by tripping the limiter.
+        const pathOnly = req.url.split("?")[0] ?? req.url;
+        req.log.warn({ ip, path: pathOnly, count: bucket.count }, RATE_LIMITED);
 
         return reply
           .status(429)